CVE catalog

CVE-2022-2447

python-keystonemiddleware: CVE-2022-2447

[CVE catalog]

Severity
Medium · CVSS 6.6CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.70% · Oct 25, 2026

A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpython-keystonemiddlewaresid13.0.1-4fixed
Debianpython-keystonemiddlewareforky13.0.1-4fixed
Debianpython-keystonemiddlewaretrixie10.9.0-2+deb13u1fixed
Debianpython-keystonemiddlewaretrixie-security10.9.0-2+deb13u1fixed
Debianpython-keystonemiddlewarebookworm10.1.0-4fixed
Ubuntukeystonepro2:16.0.0-0ubuntu1vulnerable
Ubuntukeystonepro2:17.0.0~b1~git2019121613.db81fee63-0ubuntu1vulnerable
Ubuntukeystonepro2:17.0.0~b2~git2020020513.99733f172-0ubuntu1vulnerable
Ubuntukeystonepro2:17.0.0~b3~git2020032415.9f9040257-0ubuntu1vulnerable
Ubuntukeystonepro2:17.0.0~b3~git2020032415.9f9040257-0ubuntu2vulnerable
Ubuntukeystonepro2:17.0.0~b3~git2020041013.7bb6314e4-0ubuntu1vulnerable
Ubuntukeystonepro2:17.0.0-0ubuntu0.20.04.1vulnerable
Ubuntukeystonepro2:17.0.1-0ubuntu1vulnerable
Ubuntukeystonepro2:17.0.1-0ubuntu2vulnerable
Ubuntukeystonepro2:17.0.1-0ubuntu2+esm1vulnerable
Ubuntukeystonepro2:17.0.1-0ubuntu2+esm2vulnerable
Ubuntukeystone22.042:20.0.0-0ubuntu1vulnerable
Ubuntukeystone22.042:20.0.0+git2021120815.2ddf8f321-0ubuntu1vulnerable
Ubuntukeystone22.042:20.0.0+git2022011217.771c943ad-0ubuntu1vulnerable
Ubuntukeystone22.042:20.0.0+git2022030313.a3fc9e7c3-0ubuntu1vulnerable
Ubuntukeystone22.042:21.0.0-0ubuntu1vulnerable
Ubuntukeystone22.042:21.0.1-0ubuntu1vulnerable
Ubuntukeystone22.042:21.0.1-0ubuntu2vulnerable
Ubuntukeystone22.042:21.0.1-0ubuntu2.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython-keystonemiddlewaresourcesid10.1.0-4not yet assignedNot reported[1021272]
Debianpython-keystonemiddlewaresourceforky10.1.0-4not yet assignedNot reported[1021272]
Debianpython-keystonemiddlewaresourcetrixie10.1.0-4not yet assignedNot reported[1021272]
Debianpython-keystonemiddlewaresourcebookworm10.1.0-4not yet assignedNot reported[1021272]
Ubuntukeystonedeb22.042:21.0.1-0ubuntu2.1Not reportedUBUNTU-CVE-2022-2447Not reported

[Debian bug #1021272]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [python3-keystonemiddleware]Unknown

    Source package: [python-keystonemiddleware]

    Details (2)

    • 10.1.0-4 · all · bookworm

      Fixed · Fixed: 10.1.0-4

      dsa · python-keystonemiddleware · debian · bookworm

    • 10.1.0-4 · all · bookworm

      Fixed · Fixed: 10.1.0-4

      dsa · python-keystonemiddleware · debian · bookworm

  • [python-keystonemiddleware-doc]Unknown

    Source package: [python-keystonemiddleware]

    Details (2)

    • 10.1.0-4 · all · bookworm

      Fixed · Fixed: 10.1.0-4

      dsa · python-keystonemiddleware · debian · bookworm

    • 10.1.0-4 · all · bookworm

      Fixed · Fixed: 10.1.0-4

      dsa · python-keystonemiddleware · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]