CVE-2013-4294
OpenStack Identity (Keystone) allows remote attackers to bypass intended access restrictions via revoked PKI token
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
Exploit likelihood
What each source reports
NVD Score used
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
- Record
CVE-2013-4294- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
- Record
CVE-2013-4294- Updated
- 2026-11-02
EUVDEUVD-2013-0017 No score
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
- Record
EUVD-2013-0017- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5qpp-v56f-mqfm
OpenStack Identity (Keystone) allows remote attackers to bypass intended access restrictions via revoked PKI token
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
- Record
GHSA-5qpp-v56f-mqfm- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-5qpp-v56f-mqfm
OpenStack Identity (Keystone) allows remote attackers to bypass intended access restrictions via revoked PKI token
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
- Record
GHSA-5qpp-v56f-mqfm- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSV No score
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
- Record
CVE-2013-4294- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4294 No score
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
- Record
DEBIAN-CVE-2013-4294- Updated
- 2026-11-02
OSVPYSEC-2013-42 No score
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
- Record
PYSEC-2013-42- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystonePyPI |
2012.2.0 up to 2013.1.4 | 2013.1.4 |
keystoneDebian:12 |
before 2013.1.3-2 | 2013.1.3-2 |
keystoneDebian:13 |
before 2013.1.3-2 | 2013.1.3-2 |
keystoneDebian:14 |
before 2013.1.3-2 | 2013.1.3-2 |
openstack-keystoneRed Hat:openstack:3::el6 |
before 0:2013.1.3-2.el6ost | 0:2013.1.3-2.el6ost |
openstack-keystone-docRed Hat:openstack:3::el6 |
before 0:2013.1.3-2.el6ost | 0:2013.1.3-2.el6ost |
python-keystoneRed Hat:openstack:3::el6 |
before 0:2013.1.3-2.el6ost | 0:2013.1.3-2.el6ost |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4294 is a medium vulnerability (CVSS 5.0) in Openstack Keystone, published September 23, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.70%, the 85th percentile. Fixed in keystone 2013.1.4.
References
osvdb.org/97237
ubuntu.com/usn/USN-2002-1
secunia.com/advisories/54706
seclists.org/oss-sec/2013/q3/586
bugs.launchpad.net/keystone/+bug/1202952
rhn.redhat.com/errata/RHSA-2013-1285.html
Show 11 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-4294
access.redhat.com/errata/RHSA-2013:1285
bugzilla.redhat.com/show_bug.cgi?id=1004452
github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2013-42.yaml
security-tracker.debian.org/tracker/CVE-2013-4294
opendev.org/openstack/keystone
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1285.json
cve.org/CVERecord?id=CVE-2013-4294