PT-2012-6028 · Openstack · Openstack Keystone

Anndy + 1 · Published 2012-12-18 · Updated 2023-02-13 · CVE-2012-5563

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Keystone version 2012.2

Description The issue is related to the improper implementation of token expiration in OpenStack Keystone, allowing remote authenticated users to bypass intended authorization restrictions. This is achieved by creating new tokens through token chaining.

Recommendations For OpenStack Keystone version 2012.2, update the token expiration mechanism to prevent token chaining and ensure proper authorization restrictions are enforced.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-324

CWE-863

CWE-255

Related Identifiers

CVE-2012-5563

GHSA-W66P-78G4-MR7G

PYSEC-2012-20

RHSA-2012:1557

Affected Products

Openstack Keystone

References · 19

• http://openwall.com/lists/oss-security/2012/11/28/6 · Patch
• https://osv.dev/vulnerability/GHSA-w66p-78g4-mr7g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-5563 · Security Note
• http://openwall.com/lists/oss-security/2012/11/28/5 · Patch
• http://ubuntu.com/usn/USN-1641-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1557.html · Vendor Advisory
• http://secunia.com/advisories/51423 · Vendor Advisory
• http://secunia.com/advisories/51436 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2012-20 · Vendor Advisory
• https://github.com/openstack/keystone · Note
• https://github.com/openstack/keystone/commit/f9d4766249a72d8f88d75dcf1575b28dd3496681 · Note
• https://github.com/openstack/keystone/commit/38c7e46a640a94da4da89a39a5a1ea9c081f1eb5 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2012-20.yaml · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/80370 · Note
• https://web.archive.org/web/20121201003009/http://secunia.com/advisories/51423 · Note