PT-2012-5413 · Openstack · Openstack Keystone

Rohit Karajgi · Published 2012-10-09 · Updated 2022-05-14 · CVE-2012-4457

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 2012.1.2 OpenStack Keystone Folsom versions prior to folsom-3

Description The issue is related to the improper handling of authorization tokens for disabled tenants. This allows remote authenticated users to access a tenant's resources by requesting a token for the disabled tenant.

Recommendations For OpenStack Keystone Essex versions prior to 2012.1.2, update to version 2012.1.2 or later to resolve the issue. For OpenStack Keystone Folsom versions prior to folsom-3, update to version folsom-3 or later to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2012-4457

GHSA-X8H4-XF47-PQC3

RHSA-2012:1378

Affected Products

Openstack Keystone

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2012-4457 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4457 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-4457 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-4457 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x8h4-xf47-pqc3 · Vendor Advisory
• https://github.com/openstack/keystone/commit/4ebfdfaf23c6da8e3c182bf3ec2cb2b7132ef685 · Note
• https://github.com/openstack/keystone · Note
• https://github.com/openstack/keystone/commit/5373601bbdda10f879c08af1698852142b75f8d5 · Note
• https://lists.launchpad.net/openstack/msg17035.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78947 · Note
• http://openwall.com/lists/oss-security/2012/09/28/6 · Note
• http://secunia.com/advisories/50665 · Note
• http://securityfocus.com/bid/55716 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=861180 · Note