PT-2012-5412 · Openstack · Openstack Keystone

Jason Xu · Published 2012-10-09 · Updated 2023-02-13 · CVE-2012-4456

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 2012.1.2 OpenStack Keystone Folsom versions prior to folsom-2

Description The issue concerns improper validation of the X-Auth-Token in the OS-KSADM/services and tenant APIs. This allows remote attackers to read roles for any user or perform unauthorized actions on services, including getting, creating, or deleting them.

Recommendations For OpenStack Keystone versions prior to 2012.1.2, update to version 2012.1.2 or later. For OpenStack Keystone Folsom versions prior to folsom-2, update to version folsom-2 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2012-4456

GHSA-MF98-R2GF-2X3W

RHSA-2012:1378

Affected Products

Openstack Keystone

References · 21

• https://lists.launchpad.net/openstack/msg17034.html · Patch
• http://openwall.com/lists/oss-security/2012/09/28/5 · Patch
• https://osv.dev/vulnerability/CVE-2012-4456 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mf98-r2gf-2x3w · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4456 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4456 · Security Note
• https://bugs.launchpad.net/keystone/+bug/1006822 · Patch
• http://secunia.com/advisories/50665 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-4456 · Vendor Advisory
• https://github.com/openstack/keystone/commit/14b136aed9d988f5a8f3e699bd4577c9b874d6c1 · Note
• https://github.com/openstack/keystone/commit/1d146f5c32e58a73a677d308370f147a3271c2cb · Note
• https://github.com/openstack/keystone/commit/868054992faa45d6f42d822bf1588cb88d7c9ccb · Note
• https://github.com/openstack/keystone · Note
• https://github.com/openstack/keystone/commit/24df3adb3f50cbb5ada411bc67aba8a781e6a431 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78944 · Note