CVE-2014-5252: Canonical Ubuntu Linux

Medium severity, CVSS 4.9. EPSS: 1.5% chance of exploitation in the next 30 days.

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.

Affected products

• Canonical Ubuntu Linux: version 14.04 only
• Openstack Keystone: version 2014.1 only; version 2014.1.2 only; version juno-1 only; version juno-2 only

Published 2014-08-25. Last modified 2026-06-17.