{"id":"CVE-2022-2447","aliases":["DEBIAN-CVE-2022-2447","EUVD-2022-34708","GHSA-r88f-774m-5rj4","UBUNTU-CVE-2022-2447","USN-7926-1"],"status":"published","title":"A flaw was found in OpenStack. The application credential tokens can be used even after they have...","description":"A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.","severity":{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00719,"percentile":0.54156,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-324","CWE-672"],"published":"2022-09-01T20:30:20Z","modified":"2026-11-03T08:01:04Z","fixes":[{"ecosystem":"Debian:12","package":"python-keystonemiddleware","fixed_in":["10.1.0-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-keystonemiddleware","fixed_in":["10.1.0-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-keystonemiddleware","fixed_in":["10.1.0-4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"keystone","fixed_in":["2:21.0.1-0ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"python-keystonemiddleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.0-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-keystonemiddleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.0-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-keystonemiddleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.0-4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:8.0.0-0ubuntu1","2:9.0.0~b1-0ubuntu1","2:9.0.0~b2-0ubuntu1","2:9.0.0~b3-0ubuntu1","2:9.0.0~rc1-0ubuntu1","2:9.0.0-0ubuntu1","2:9.0.2-0ubuntu1","2:9.0.2-0ubuntu2","2:9.1.0-0ubuntu1","2:9.2.0-0ubuntu1","2:9.3.0-0ubuntu1","2:9.3.0-0ubuntu2","2:9.3.0-0ubuntu3","2:9.3.0-0ubuntu3.1","2:9.3.0-0ubuntu3.2","2:9.3.0-0ubuntu3.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:12.0.0-0ubuntu1","2:13.0.0~b1-0ubuntu1","2:13.0.0~b2-0ubuntu1","2:13.0.0~b3-0ubuntu1","2:13.0.0~rc1-0ubuntu1","2:13.0.0~rc2-0ubuntu1","2:13.0.0-0ubuntu1","2:13.0.1-0ubuntu1","2:13.0.2-0ubuntu1","2:13.0.2-0ubuntu3","2:13.0.4-0ubuntu1","2:13.0.4-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:16.0.0-0ubuntu1","2:17.0.0~b1~git2019121613.db81fee63-0ubuntu1","2:17.0.0~b2~git2020020513.99733f172-0ubuntu1","2:17.0.0~b3~git2020032415.9f9040257-0ubuntu1","2:17.0.0~b3~git2020032415.9f9040257-0ubuntu2","2:17.0.0~b3~git2020041013.7bb6314e4-0ubuntu1","2:17.0.0-0ubuntu0.20.04.1","2:17.0.1-0ubuntu1","2:17.0.1-0ubuntu2","2:17.0.1-0ubuntu2+esm1","2:17.0.1-0ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.0.1-0ubuntu2.1"}]}],"versions":["2:20.0.0-0ubuntu1","2:20.0.0+git2021120815.2ddf8f321-0ubuntu1","2:20.0.0+git2022011217.771c943ad-0ubuntu1","2:20.0.0+git2022030313.a3fc9e7c3-0ubuntu1","2:21.0.0-0ubuntu1","2:21.0.1-0ubuntu1","2:21.0.1-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.0.1-0ubuntu2.1"}]}],"versions":["2:20.0.0-0ubuntu1","2:20.0.0+git2021120815.2ddf8f321-0ubuntu1","2:20.0.0+git2022011217.771c943ad-0ubuntu1","2:20.0.0+git2022030313.a3fc9e7c3-0ubuntu1","2:21.0.0-0ubuntu1","2:21.0.1-0ubuntu1","2:21.0.1-0ubuntu2"],"bundled":3}],"products":[{"vendor":"[unknown]","product":"openstack-keystone"},{"vendor":"openstack","product":"keystone"},{"vendor":"redhat","product":"openstack_platform"},{"vendor":"redhat","product":"quay"},{"vendor":"redhat","product":"storage"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105419","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2447","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2447"},{"url":"https://github.com/advisories/GHSA-r88f-774m-5rj4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-2447","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-2447","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2447","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7926-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-65073","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-2447","description":"A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.","status":"published","published":"2022-09-01T20:30:20Z","modified":"2024-08-03T00:39:07.647Z","cwes":["CWE-324"],"updated_at":"2026-11-02T14:34:32.843656Z"}],"euvd":[{"id":"EUVD-2022-34708","description":"A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.","status":"published","published":"2022-09-01T20:30:20Z","modified":"2024-08-03T00:39:07Z","updated_at":"2026-11-03T03:25:58.383516Z"}],"ghsa":[{"id":"GHSA-r88f-774m-5rj4","title":"A flaw was found in OpenStack. The application credential tokens can be used even after they have...","description":"A flaw was found in OpenStack. The application credential tokens can be used even after they have expired. This flaw allows an authenticated remote attacker to obtain access despite the defender's efforts to remove access.","status":"published","published":"2022-09-02T00:01:02Z","modified":"2023-01-30T05:06:07Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-672"],"updated_at":"2026-11-02T14:47:25.8676Z"}],"nvd":[{"id":"CVE-2022-2447","description":"A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.","status":"published","published":"2022-09-01T21:15:09.547Z","modified":"2026-06-17T04:41:54.857Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-324","CWE-672"],"updated_at":"2026-11-02T14:07:26.802986Z"}],"osv":[{"id":"CVE-2022-2447","description":"A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.","status":"published","published":"2022-09-01T21:15:09.547Z","modified":"2026-03-14T01:44:20.145216Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"DEBIAN-CVE-2022-2447","description":"A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.","status":"published","published":"2022-09-01T21:15:09.547Z","modified":"2026-11-03T08:01:04.629811529Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"UBUNTU-CVE-2022-2447","description":"A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.","status":"published","published":"2022-09-01T21:15:00Z","modified":"2026-09-30T18:20:44.031995116Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"USN-7926-1","title":"keystone vulnerabilities","description":"Kay discovered that OpenStack Keystone incorrectly handled the ec2tokens\nand s3tokens APIs. A remote attacker could possibly use this issue to\nobtain unauthorized access and escalate privileges. (CVE-2025-65073)\n\nIt was discovered that OpenStack Keystone only validated the first 72\nbytes of an application secret. An attacker could possibly use this issue\nto bypass password complexity. (CVE-2021-3563)\n\nIt was discovered that OpenStack Keystone had a time lag before a token\nshould be revoked by the security policy. A remote administrator could use\nthis issue to maintain access for longer than expected. (CVE-2022-2447)","status":"published","published":"2025-12-11T14:24:04Z","modified":"2026-04-27T18:31:24.877333Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}