Ubuntu Security Notice 1830-1 - Sam Stoelinga discovered that Keystone would not immediately invalidate tokens when deleting users via the v2 API. A deleted user would be able to continue to use resources until the token lifetime expired.
38838c5ed78fd69e0eaf7bf0a4e219d724788214094082f438bf80465530746a