Every CVE Search/ Get API key

CVE-2014-2237

OpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend

5.0 MediumFix available

The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.

Exploit likelihood

1.37%Up 0.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.

Record
CVE-2014-2237
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.

Record
CVE-2014-2237
Updated
2026-11-02
EUVDEUVD-2014-0025 No score

The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.

Record
EUVD-2014-0025
Updated
2026-11-03
GitHub AdvisoriesGHSA-23x9-8hxr-978c 7.1

OpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend

The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.

Record
GHSA-23x9-8hxr-978c
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-287, CWE-1270
Updated
2026-11-02
OSVGHSA-23x9-8hxr-978c 7.1

OpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend

The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.

Record
GHSA-23x9-8hxr-978c
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-1270, CWE-287
Updated
2026-11-02
OSV No score

The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.

Record
CVE-2014-2237
Updated
2026-11-02
OSVDEBIAN-CVE-2014-2237 No score

The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.

Record
DEBIAN-CVE-2014-2237
Updated
2026-11-02
OSVPYSEC-2014-105 No score

The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.

Record
PYSEC-2014-105
Updated
2026-11-02
OSVUBUNTU-CVE-2014-2237 No score

The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.

Record
UBUNTU-CVE-2014-2237
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
keystone
PyPI
 before 8.0.0a0
8.0.0a0
keystone
Debian:12
 before 2013.2.3-1
2013.2.3-1
keystone
Debian:13
 before 2013.2.3-1
2013.2.3-1
keystone
Debian:14
 before 2013.2.3-1
2013.2.3-1
openstack-keystone
Red Hat:openstack:3::el6
 before 0:2013.1.5-2.el6ost
0:2013.1.5-2.el6ost
openstack-keystone-doc
Red Hat:openstack:3::el6
 before 0:2013.1.5-2.el6ost
0:2013.1.5-2.el6ost
python-keystone
Red Hat:openstack:3::el6
 before 0:2013.1.5-2.el6ost
0:2013.1.5-2.el6ost
openstack-keystone
Red Hat:openstack:4::el6
 before 0:2013.2.3-4.el6ost
0:2013.2.3-4.el6ost
openstack-keystone-doc
Red Hat:openstack:4::el6
 before 0:2013.2.3-4.el6ost
0:2013.2.3-4.el6ost
python-keystone
Red Hat:openstack:4::el6
 before 0:2013.2.3-4.el6ost
0:2013.2.3-4.el6ost

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-2237 is a medium vulnerability (CVSS 5.0) in Openstack Keystone, published April 1, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.37%, the 71st percentile. Fixed in keystone 8.0.0a0.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open