OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows remote authenticated users to retain access via a domain-scoped token for that domain.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5253
Reference (s):
- https://bugs.launchpad.net/keystone/+bug/1349597
- MLIST:[oss-security] 20140815 [OSSA 2014-026] Multiple vulnerabilities in Keystone revocation events (CVE-2014-5251, CVE-2014-5252, CVE-2014-5253)
- URL: http://www.openwall.com/lists/oss-security/2014/08/15/6
- REDHAT:RHSA-2014:1121
- URL: http://rhn.redhat.com/errata/RHSA-2014-1121.html