CVE-2013-6391

Name	CVE-2013-6391
Description	The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	731981

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
keystone (PTS)	buster	2:14.2.0-0+deb10u1	fixed
	buster (security)	2:14.2.0-0+deb10u2	fixed
	bullseye	2:18.0.0-3+deb11u1	fixed
	bookworm	2:22.0.0-2	fixed
	sid, trixie	2:25.0.0-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
keystone	source	wheezy	(not affected)
keystone	source	(unstable)	2013.2.1-1			731981

[wheezy] - keystone <not-affected> (vulnerable code not present)
https://launchpad.net/bugs/1242597