PT-2012-5412 · Openstack · Openstack Keystone

Jason Xu · Publicado 2012-10-09 · Atualizado 2023-02-13 · CVE-2012-4456

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 2012.1.2 OpenStack Keystone Folsom versions prior to folsom-2

Description The issue concerns improper validation of the X-Auth-Token in the OS-KSADM/services and tenant APIs. This allows remote attackers to read roles for any user or perform unauthorized actions on services, including getting, creating, or deleting them.

Recommendations For OpenStack Keystone versions prior to 2012.1.2, update to version 2012.1.2 or later. For OpenStack Keystone Folsom versions prior to folsom-2, update to version folsom-2 or later.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2012-4456

GHSA-MF98-R2GF-2X3W

RHSA-2012:1378

Produtos afetados

Openstack Keystone

Referências · 21

• https://github.com/openstack/keystone/commit/14b136aed9d988f5a8f3e699bd4577c9b874d6c1 · Nota
• https://github.com/openstack/keystone/commit/1d146f5c32e58a73a677d308370f147a3271c2cb · Nota
• https://github.com/openstack/keystone/commit/868054992faa45d6f42d822bf1588cb88d7c9ccb · Nota
• https://github.com/openstack/keystone · Nota
• https://github.com/openstack/keystone/commit/24df3adb3f50cbb5ada411bc67aba8a781e6a431 · Nota
• https://lists.launchpad.net/openstack/msg17034.html · Correção
• http://openwall.com/lists/oss-security/2012/09/28/5 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78944 · Nota
• https://osv.dev/vulnerability/CVE-2012-4456 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-mf98-r2gf-2x3w · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4456 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-4456 · Nota de Segurança
• https://bugs.launchpad.net/keystone/+bug/1006822 · Correção
• https://access.redhat.com/security/cve/CVE-2012-4456 · Nota
• http://secunia.com/advisories/50665 · Aviso do Fabricante