PT-2012-6311 · Openstack · Openstack Keystone

Published 2012-12-18 · Updated 2012-12-18

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions 2012.1 through 2012.2

Description The issue allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for a removed user role, due to improper handling of EC2 tokens when the user role has been removed from a tenant.

Recommendations For versions 2012.1 and 2012.2, consider restricting access to EC2 tokens for removed user roles until a proper fix is applied. As a temporary workaround, review and manually revoke tokens for user roles that have been removed from a tenant to minimize the risk of exploitation.

Related Identifiers

PYSEC-2012-35

Affected Products

Openstack Keystone

References · 15

• https://osv.dev/vulnerability/PYSEC-2012-35 · Vendor Advisory
• https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b · Note
• https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19 · Note
• https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653 · Note
• https://bugs.launchpad.net/keystone/+bug/1064914 · Note
• http://securityfocus.com/bid/56726 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/80333 · Note
• http://openwall.com/lists/oss-security/2012/11/28/5 · Note
• http://secunia.com/advisories/51423 · Note
• http://secunia.com/advisories/51436 · Note
• http://rhn.redhat.com/errata/RHSA-2012-1556.html · Note
• http://rhn.redhat.com/errata/RHSA-2012-1557.html · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html · Note
• http://ubuntu.com/usn/USN-1641-1 · Note
• http://openwall.com/lists/oss-security/2012/11/28/6 · Note