CVE-2014-5253: Canonical Ubuntu Linux

Medium severity, CVSS 4.9. EPSS: 1.5% chance of exploitation in the next 30 days.

OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows remote authenticated users to retain access via a domain-scoped token for that domain.

Affected products

• Canonical Ubuntu Linux: version 14.04 only
• Openstack Keystone: version 2014.1 only; version 2014.1.2 only; version juno-1 only; version juno-2 only

Published 2014-08-25. Last modified 2026-06-17.