PT-2012-6028 · Openstack · Openstack Keystone

Anndy + 1 · Publicado 2012-12-18 · Atualizado 2023-02-13 · CVE-2012-5563

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Keystone version 2012.2

Description The issue is related to the improper implementation of token expiration in OpenStack Keystone, allowing remote authenticated users to bypass intended authorization restrictions. This is achieved by creating new tokens through token chaining.

Recommendations For OpenStack Keystone version 2012.2, update the token expiration mechanism to prevent token chaining and ensure proper authorization restrictions are enforced.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-324

CWE-863

CWE-255

Identificadores relacionados

CVE-2012-5563

GHSA-W66P-78G4-MR7G

PYSEC-2012-20

RHSA-2012:1557

Produtos afetados

Openstack Keystone

Referências · 19

• https://github.com/openstack/keystone · Nota
• https://github.com/openstack/keystone/commit/f9d4766249a72d8f88d75dcf1575b28dd3496681 · Nota
• https://github.com/openstack/keystone/commit/38c7e46a640a94da4da89a39a5a1ea9c081f1eb5 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2012-20.yaml · Nota
• http://openwall.com/lists/oss-security/2012/11/28/6 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/80370 · Nota
• https://osv.dev/vulnerability/GHSA-w66p-78g4-mr7g · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-5563 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/11/28/5 · Correção
• http://ubuntu.com/usn/USN-1641-1 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2012-1557.html · Aviso do Fabricante
• http://secunia.com/advisories/51423 · Aviso do Fabricante
• https://web.archive.org/web/20121201003009/http://secunia.com/advisories/51423 · Nota
• https://bugs.launchpad.net/keystone/+bug/1079216 · Nota
• http://securityfocus.com/bid/56727 · Nota