CVE-2022-2447: openstack keystone Use of a Key Past its Expiration Date

Vulnerability summary

CVE-2022-2447 is a medium (CVSS 6.6) Use of a Key Past its Expiration Date vulnerability in openstack keystone. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 53.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 01-09-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.

• CWE-324Use of a Key Past its Expiration DateThe product uses a cryptographic key past its expiration date.
• CWE-672Operation on a Resource after Expiration or ReleaseThe product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.