PyPI/keystone CVE-2014-2237: medium 6.5, EPSS 1.37%

OpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend

Action: Upgrade keystone to 8.0.0a0 or later.

pip install keystone==8.0.0a0

Affected

Fixed versions

Sources

• osv: GHSA-23x9-8hxr-978c
• https://nvd.nist.gov/vuln/detail/CVE-2014-2237
• https://github.com/openstack/keystone/commit/813d1254eb4f7a7d40009b23bbadbc4c5cc5daac
• https://github.com/openstack/keystone/commit/a411c944af78c36f2fdb87d305ba452dc52d7ed3
• https://github.com/openstack/keystone/commit/b6f0e26da0e2ab0892a5658da281a065e668637b
• https://bugs.launchpad.net/keystone/+bug/1260080
• https://github.com/openstack/keystone
• https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2014-105.yaml
• https://rhn.redhat.com/errata/RHSA-2014-0580.html
• http://www.openwall.com/lists/oss-security/2014/03/04/16

CVE-2014-2237 · published 2022-05-17T04:13:50Z · modified 2025-04-13T23:04:52Z · JSON