PT-2012-5384 · Openstack · Openstack Keystone

Dolph Mathews · Publicado 2012-09-18 · Atualizado 2023-02-13 · CVE-2012-4413

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 2012.1.3

Description The issue allows remote authenticated users to retain the privileges of revoked roles because existing tokens are not invalidated when roles are granted or revoked.

Recommendations For versions prior to 2012.1.3, update to version 2012.1.3 or later to ensure that existing tokens are properly invalidated when roles are granted or revoked.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-4413

GHSA-MRXV-65RV-6HXQ

RHSA-2012:1378

Produtos afetados

Openstack Keystone

Referências · 20

• http://github.com/openstack/keystone/commit/58ac6691a21675be9e2ffb0f84a05fc3cd4d2e2e · Nota
• https://security-tracker.debian.org/tracker/CVE-2012-4413 · Aviso do Fabricante
• http://ubuntu.com/usn/USN-1564-1 · Aviso do Fabricante
• http://secunia.com/advisories/50531 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2012-4413 · Aviso do Fabricante
• https://web.archive.org/web/20121114023848/http://securityfocus.com/bid/55524 · Nota
• http://secunia.com/advisories/50590 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-4413 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4413 · Aviso do Fabricante
• https://opendev.org/openstack/keystone · Nota
• http://osvdb.org/85484 · Nota
• http://securityfocus.com/bid/55524 · Nota
• https://osv.dev/vulnerability/GHSA-mrxv-65rv-6hxq · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/09/12/7 · Nota
• https://review.opendev.org/c/openstack/keystone/+/12870 · Nota