Published: 18/12/2012 Updated: 29/08/2017

CVSS v2 Base Score: 3.5 | Impact Score: 2.9 | Exploitability Score: 6.8

VMScore: 312

Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N

OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openstack folsom 2012.2
openstack essex 2012.1

Keystone would allow unintended access to files over the network ...

Synopsis Moderate: openstack-keystone security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic Updated openstack-keystone packages that fix two security issues, multiplebugs, and add enhancements are now available for Red Hat OpenStack EssexThe Red Hat Security Response Tea ...

Synopsis Moderate: openstack-keystone security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic Updated openstack-keystone packages that fix two security issues, multiplebugs, and add enhancements are now available for Red Hat OpenStack FolsomThe Red Hat Security Response Te ...

CWE-255 http://www.openwall.com/lists/oss-security/2012/11/28/5 http://www.openwall.com/lists/oss-security/2012/11/28/6 http://secunia.com/advisories/51423 http://www.ubuntu.com/usn/USN-1641-1 http://secunia.com/advisories/51436 https://bugs.launchpad.net/keystone/+bug/1064914 https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19 https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653 http://rhn.redhat.com/errata/RHSA-2012-1556.html http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html http://rhn.redhat.com/errata/RHSA-2012-1557.html http://www.securityfocus.com/bid/56726 https://exchange.xforce.ibmcloud.com/vulnerabilities/80333 https://usn.ubuntu.com/1641-1/https://nvd.nist.gov

CVE-2012-5571

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect