GCVE - cpe:2.3:a:openstack:keystone:2013.1.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:openstack:keystone:2013.1.1:*:*:*:*:*:*:*

part: a version: 2013.1.1 update: *

Vendor	Openstack (`7b0cf974-b2b5-592e-bdf4-6953805ef02a`)
Product	Keystone (`54be5cb9-7f0d-5cc5-bfca-6220fcd705e3`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/keystone`	purl2cpe	2026-06-01 10:17:03.366014
`pkg:deb/ubuntu/keystone`	purl2cpe	2026-06-01 10:17:03.366016
`pkg:github/openstack/keystone`	purl2cpe	2026-06-01 10:17:03.366017
`pkg:pypi/keystone`	purl2cpe	2026-06-01 10:17:03.366018

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-2828`	vulnerable	2026-06-03 14:33:51.857180	Details available The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the same authentication method in a request, aka "authentication chaining." Published: 2014-04-15T14:00:00.000Z Updated: 2024-08-06T10:28:45.404Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2014-1688.html http://www.openwall.com/lists/oss-security/2014/04/10/20 https://bugs.launchpad.net/keystone/+bug/1300274	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-2237`	vulnerable	2026-06-03 14:33:50.082521	Details available The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions. Published: 2014-04-01T01:00:00.000Z Updated: 2024-08-06T10:06:00.289Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2014/03/04/16 http://www.securityfocus.com/bid/65895 https://bugs.launchpad.net/keystone/+bug/1260080 http://rhn.redhat.com/errata/RHSA-2014-0580.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4294`	vulnerable	2026-06-03 14:33:10.904777	Details available The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token. Published: 2013-09-23T20:00:00.000Z Updated: 2024-08-06T16:38:01.910Z Open on db.gcve.eu Reference links http://osvdb.org/97237 http://www.ubuntu.com/usn/USN-2002-1 http://secunia.com/advisories/54706 http://seclists.org/oss-sec/2013/q3/586 https://bugs.launchpad.net/keystone/+bug/1202952	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2006`	vulnerable	2026-06-03 14:32:53.139466	Details available OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in plaintext, which allows local users to obtain sensitive by reading the log file. Published: 2013-05-21T18:00:00.000Z Updated: 2024-08-06T15:20:37.444Z Open on db.gcve.eu Reference links https://github.com/openstack/keystone/commit/c5037dd6b82909efaaa8720e8cfa8bdb8b4a0edd http://www.securityfocus.com/bid/59411 http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html https://bugs.launchpad.net/ossn/+bug/1168252 http://rhn.redhat.com/errata/RHSA-2013-0806.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.