[Secure-testing-team] Bug#824683: keystone: CVE-2016-4911: Incorrect Audit IDs in Keystone Fernet Tokens can result in revocation bypass

[Salvatore Bonaccorso]

Source: keystone
Version: 2:9.0.0-1
Severity: grave
Tags: security patch upstream

Hi,

the following vulnerability was published for keystone.

CVE-2016-4911[0]:
Incorrect Audit IDs in Keystone Fernet Tokens can result in revocation bypass

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-4911
[1] https://bugs.launchpad.net/keystone/+bug/1577558

Regards,
Salvatore