CVE-2025-65073

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-65073", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-11-17T23:04:04.827Z", "dateReserved": "2025-11-17T00:00:00.000Z", "datePublished": "2025-11-17T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Keystone", "vendor": "OpenStack", "versions": [{"lessThan": "26.0.1", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "affected", "version": "27.0.0", "versionType": "custom"}, {"status": "affected", "version": "28.0.0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-11-17T07:44:20.582Z"}, "references": [{"url": "https://www.openwall.com/lists/oss-security/2025/11/04/2"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N"}}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.0.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*", "versionStartIncluding": "27.0.0", "versionEndIncluding": "27.0.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*", "versionStartIncluding": "28.0.0", "versionEndIncluding": "28.0.0"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-17T16:34:17.189065Z", "id": "CVE-2025-65073", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-17T16:34:52.132Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/11/17/6"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-17T23:04:04.827Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/11/17/6"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-17T23:04:04.827Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-65073", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-17T16:34:17.189065Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-17T16:34:44.305Z"}}], "cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N"}}], "affected": [{"vendor": "OpenStack", "product": "Keystone", "versions": [{"status": "affected", "version": "0", "lessThan": "26.0.1", "versionType": "custom"}, {"status": "affected", "version": "27.0.0", "versionType": "custom"}, {"status": "affected", "version": "28.0.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.openwall.com/lists/oss-security/2025/11/04/2"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "descriptions": [{"lang": "en", "value": "OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "26.0.1"}, {"criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "27.0.0", "versionStartIncluding": "27.0.0"}, {"criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "28.0.0", "versionStartIncluding": "28.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-11-17T07:44:20.582Z"}}}, "cveMetadata": {"cveId": "CVE-2025-65073", "state": "PUBLISHED", "dateUpdated": "2025-11-17T23:04:04.827Z", "dateReserved": "2025-11-17T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2025-11-17T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Keystone", "vendor": "OpenStack", "versions": [{"lessThan": "26.0.1", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "affected", "version": "27.0.0", "versionType": "custom"}, {"status": "affected", "version": "28.0.0", "versionType": "custom"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization."}, {"lang": "es", "value": "OpenStack Keystone antes de 26.0.1, 27.0.0 y 28.0.0 permite que una solicitud /v3/ec2tokens o /v3/s3tokens con una firma AWS v\u00e1lida proporcione autorizaci\u00f3n de Keystone."}], "id": "CVE-2025-65073", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.7, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65073", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-17T16:34:17.189065Z", "version": "2.0.3"}}]}, "published": "2025-11-17T08:16:25.600", "references": [{"source": "cve@mitre.org", "url": "https://www.openwall.com/lists/oss-security/2025/11/04/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2025/11/17/6"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "openstack-keystone: OpenStack Keystone: Unauthorized access and privilege escalation via AWS signature validation flaw", "id": "2415344", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2415344"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N", "status": "draft"}, "cwe": "CWE-863", "details": ["OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.", "A flaw was found in OpenStack Keystone. This vulnerability allows an attacker to obtain a valid OpenStack's Keystone token, leading to access to unauthorized resources or privilege escalation within the OpenStack instance via sending a valid AWS (Amazon Web Services) signature to the /v3/ec2tokens or /v3/s3tokens API (Application Programming Interface) endpoints."], "mitigation": {"lang": "en:us", "value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."}, "name": "CVE-2025-65073", "package_state": [{"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Affected", "package_name": "rhosp13/openstack-keystone", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "openstack-keystone", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "rhosp-rhel8/openstack-keystone", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "openstack-keystone", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "rhosp-rhel9/openstack-keystone", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "openstack-keystone", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "rhoso/openstack-keystone-rhel9", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2025-11-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-65073\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-65073\nhttps://www.openwall.com/lists/oss-security/2025/11/04/2"], "statement": "This vulnerability allows an attacker to obtain a valid OpenStack's Keystone token belonging to a valid user by sending a valid AWS signature to the /v3/ec2tokens or /v3/s3tokens API's endpoints, leading to access to unauthorized resources or privilege escalation within the OpenStack instance.\nThis attack is considered to have a high complexity (AC:H) due to the fact of obtaining such valid AWS token is not straight forward. To be considered vulnerable, the OpenStack deployments should expose the related API end points through a public API or external access.", "threat_severity": "Important"}

{"created": "2025-11-17T15:15:21.074163+00:00", "updated": "2025-11-17T15:15:21.074189+00:00", "vendors": ["openstack", "openstack$PRODUCT$keystone"]}