CVE-2014-5251

Severity CVSS v4.0:

Pending analysis

Type:

CWE-255 Credentials Management

Publication date:

25/08/2014

Last modified:

12/04/2025

Description

The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token.

Impact

Vector 2.0

AV:N/AC:M/Au:S/C:P/I:P/A:N CVSS v2.0 Severity and Metrics:

Base Score: 4.90 MEDIUM
Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N

Attack Vector (AV): Network
Attack Complexity (AC): Medium
Authentication (Au): Single
Confidentiality (C): Physical
Integrity (I): Physical
Availability (A): None

Base Score 2.0

4.90

Severity 2.0

MEDIUM

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:openstack:keystone:2014.1:::::::*
cpe:2.3:a:openstack:keystone:2014.1.2:::::::*
cpe:2.3:a:openstack:keystone:juno-1:::::::*
cpe:2.3:a:openstack:keystone:juno-2:::::::*
cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::

To consult the complete list of CPE names with products and versions, see this page

CPE	From	Up to
cpe:2.3:a:openstack:keystone:2014.1:::::::*
cpe:2.3:a:openstack:keystone:2014.1.2:::::::*
cpe:2.3:a:openstack:keystone:juno-1:::::::*
cpe:2.3:a:openstack:keystone:juno-2:::::::*
cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::

CVE-2014-5251

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools