Solution
Please Install the Updated Packages.
Insight
Steven Hardy discovered that Keystone did not properly enforce trusts when using the ec2tokens API. An authenticated attacker could exploit this to retrieve a token not scoped to the trust and elevate privileges to the trustor's roles.
Affected
keystone on Ubuntu 13.10
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2013-6391 -
CVSS Base Score: 5.8
AV:N/AC:M/Au:N/C:P/I:P/A:N
Related Vulnerabilities