A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.
The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
| Link | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=2105419 | issue tracking exploit vendor advisory |
| https://access.redhat.com/security/cve/CVE-2022-2447 | vendor advisory |