PT-2012-6031 · Openstack · Openstack Keystone

Vijaya Erukala · Publicado 2012-12-18 · Atualizado 2022-05-17 · CVE-2012-5571

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions 2012.1 through 2012.2

Description The issue allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for a removed user role, due to improper handling of EC2 tokens when the user role has been removed from a tenant.

Recommendations For versions 2012.1 and 2012.2, consider restricting access to EC2 tokens for removed user roles until a proper fix is applied. As a temporary workaround, review and manually revoke tokens for user roles that have been removed from a tenant to minimize the risk of exploitation.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

CWE-255

Identificadores relacionados

CVE-2012-5571

GHSA-QVPR-QM6W-6RCC

PYSEC-2012-35

RHSA-2012:1556

RHSA-2012:1557

Produtos afetados

Openstack Keystone

Referências · 24

• https://github.com/openstack/keystone · Nota
• https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653 · Correção
• https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19 · Correção
• https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b · Correção
• https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2012-35.yaml · Nota
• http://openwall.com/lists/oss-security/2012/11/28/5 · Correção
• http://ubuntu.com/usn/USN-1641-1 · Aviso do Fabricante
• http://secunia.com/advisories/51436 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/11/28/6 · Correção
• http://rhn.redhat.com/errata/RHSA-2012-1556.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2012-1557.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-5571 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/80333 · Nota
• http://secunia.com/advisories/51423 · Aviso do Fabricante