{"action":"Upgrade keystone to 9.0.1 or later.","affected":[{"fixed":"9.0.1","introduced":"9.0.0"}],"component":"keystone","cve_ids":["CVE-2016-4911"],"ecosystem":"PyPI","epss":0.01402,"exploited":false,"fixed_versions":["9.0.1"],"ghsa_id":"GHSA-f82m-w3p3-cgp3","id":"tcs_01M5KG6Y0YFDEQ8E3E7K4F6V1Q","modified_at":"2024-11-25T22:42:22.796252Z","published_at":"2016-06-13T14:59:00Z","references":["https://osv.dev/vulnerability/PYSEC-2016-38","http://www.openwall.com/lists/oss-security/2016/05/17/10","https://security.openstack.org/ossa/OSSA-2016-008.html","https://review.openstack.org/#/c/311886/","http://www.openwall.com/lists/oss-security/2016/05/17/11","https://bugs.launchpad.net/keystone/+bug/1577558","http://www.securityfocus.com/bid/90728"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"PYSEC-2016-38","url":"https://osv.dev/vulnerability/PYSEC-2016-38"}],"summary":"The Fernet Token Provider in OpenStack Identity (Keystone) 9.0.x before 9.0.1 (mitaka) allows remote authenticated users to prevent revocation of a chain of tokens and bypass intended access restricti"}