What’s Vulnerable › Vulnerabilities

CVE-2022-2447

• Severity: medium (CVSS 6.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-09-01 · updated 2026-06-17
• Weakness: CWE-324

Description

A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.

Affected products

• OpenStack Keystone: all versions
• nova_libvirt container provided by the Red Hat OpenStack Platform: 16.1, 16.2
• Red Hat Quay 3: 3.0.0
• RedHat Storage: 3.0

References

• https://access.redhat.com/security/cve/CVE-2022-2447
• https://bugzilla.redhat.com/show_bug.cgi?id=2105419
• https://access.redhat.com/security/cve/CVE-2022-2447
• https://bugzilla.redhat.com/show_bug.cgi?id=2105419

Get alerted when CVE-2022-2447 or the next vulnerability affects your stack