PT-2012-5384 · Openstack · Openstack Keystone

Dolph Mathews · Published 2012-09-18 · Updated 2023-02-13 · CVE-2012-4413

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 2012.1.3

Description The issue allows remote authenticated users to retain the privileges of revoked roles because existing tokens are not invalidated when roles are granted or revoked.

Recommendations For versions prior to 2012.1.3, update to version 2012.1.3 or later to ensure that existing tokens are properly invalidated when roles are granted or revoked.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-4413

GHSA-MRXV-65RV-6HXQ

RHSA-2012:1378

Affected Products

Openstack Keystone

References · 20

• https://security-tracker.debian.org/tracker/CVE-2012-4413 · Vendor Advisory
• http://ubuntu.com/usn/USN-1564-1 · Vendor Advisory
• http://secunia.com/advisories/50531 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-4413 · Vendor Advisory
• http://secunia.com/advisories/50590 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4413 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4413 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mrxv-65rv-6hxq · Vendor Advisory
• http://github.com/openstack/keystone/commit/58ac6691a21675be9e2ffb0f84a05fc3cd4d2e2e · Note
• https://web.archive.org/web/20121114023848/http://securityfocus.com/bid/55524 · Note
• https://opendev.org/openstack/keystone · Note
• http://osvdb.org/85484 · Note
• http://securityfocus.com/bid/55524 · Note
• http://openwall.com/lists/oss-security/2012/09/12/7 · Note
• https://review.opendev.org/c/openstack/keystone/+/12870 · Note