Your submission was sent successfully! Close

CVE-2014-0204

Published: 3 November 2014

OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID.

Priority

Status

Package	Release	Status
keystone Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Not vulnerable
	saucy	Not vulnerable
	trusty	Does not exist (trusty was not-affected [1:2014.1.1-0ubuntu1])
	upstream	Needs triage
	utopic	Not vulnerable (1:2014.2~b2-0ubuntu1)

Notes

Author	Note
mdeslaur	OSSA 2014-015 watch for regression mentioned in tracker only icehouse and higher

References

Bugs

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›

Further reading