CVE-2013-4222: Canonical Ubuntu Linux

Medium severity, CVSS 6.5. EPSS: 1.9% chance of exploitation in the next 30 days.

OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token.

Affected products

• Canonical Ubuntu Linux: version 12.10 only; version 13.04 only
• Fedoraproject Fedora: version 20 only
• Openstack Keystone: from 2013.1, up to and including 2013.1.3
• Red Hat Openstack: version 3.0 only

Published 2013-09-30. Last modified 2026-06-16.