PT-2012-6311 · Openstack · Openstack Keystone

Publicado 2012-12-18 · Atualizado 2012-12-18

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions 2012.1 through 2012.2

Description The issue allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for a removed user role, due to improper handling of EC2 tokens when the user role has been removed from a tenant.

Recommendations For versions 2012.1 and 2012.2, consider restricting access to EC2 tokens for removed user roles until a proper fix is applied. As a temporary workaround, review and manually revoke tokens for user roles that have been removed from a tenant to minimize the risk of exploitation.

Identificadores relacionados

PYSEC-2012-35

Produtos afetados

Openstack Keystone

Referências · 15

• https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b · Nota
• https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19 · Nota
• https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653 · Nota
• https://bugs.launchpad.net/keystone/+bug/1064914 · Nota
• http://securityfocus.com/bid/56726 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/80333 · Nota
• http://openwall.com/lists/oss-security/2012/11/28/5 · Nota
• http://secunia.com/advisories/51423 · Nota
• http://secunia.com/advisories/51436 · Nota
• http://rhn.redhat.com/errata/RHSA-2012-1556.html · Nota
• https://osv.dev/vulnerability/PYSEC-2012-35 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2012-1557.html · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html · Nota
• http://ubuntu.com/usn/USN-1641-1 · Nota
• http://openwall.com/lists/oss-security/2012/11/28/6 · Nota