PT-2012-4796 · Openstack · Openstack Keystone+1

Dolph Mathews · Publicado 2012-09-05 · Atualizado 2023-02-13 · CVE-2012-3542

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to folsom-rc1 OpenStack Essex (2012.1)

Description The issue allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API.

Recommendations For OpenStack Keystone versions prior to folsom-rc1, update to folsom-rc1 or later to resolve the issue. For OpenStack Essex (2012.1), consider upgrading to a newer version that is not affected by this issue. As a temporary workaround, consider restricting access to the administrative API to minimize the risk of exploitation.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-264

CWE-284

Identificadores relacionados

CVE-2012-3542

GHSA-GF2Q-J2QQ-PJF2

PYSEC-2012-19

RHSA-2012:1378

Produtos afetados

Openstack Essex

Openstack Keystone

Referências · 20

• https://github.com/openstack/keystone/commit/c13d0ba606f7b2bdc609a7f388334e5efec3f3aa · Correção
• https://github.com/openstack/keystone/commit/5438d3b5a219d7c8fa67e66e538d325a61617155 · Correção
• https://github.com/openstack/keystone · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2012-19.yaml · Nota
• https://osv.dev/vulnerability/PYSEC-2012-19 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-gf2q-j2qq-pjf2 · Aviso do Fabricante
• https://bugs.launchpad.net/keystone/+bug/1040626 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-3542 · Nota de Segurança
• https://lists.launchpad.net/openstack/msg16282.html · Nota
• http://securityfocus.com/bid/55326 · Nota
• https://security-tracker.debian.org/tracker/CVE-2012-3542 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/08/30/6 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3542 · Aviso do Fabricante
• https://web.archive.org/web/20121114023909/http://securityfocus.com/bid/55326 · Nota
• https://osv.dev/vulnerability/CVE-2012-3542 · Aviso do Fabricante