CVE-2012-4413 OpenStack Keystone does not invalidate existing tokens when granting or revoking roles
MediumCVSS 4.0
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi keystone(PyPI) | < 2012.1.3 | 2012.1.3 |
| pypi keystone(PyPI) | = 12.0.2 | No fix listed |
| pypi keystone(PyPI) | = 12.0.3 | No fix listed |
| pypi keystone(PyPI) | = 13.0.2 | No fix listed |
| pypi keystone(PyPI) | = 13.0.3 | No fix listed |
| pypi keystone(PyPI) | = 13.0.4 | No fix listed |
| pypi keystone(PyPI) | = 14.0.0 | No fix listed |
| pypi keystone(PyPI) | = 14.0.1 | No fix listed |
| pypi keystone(PyPI) | = 14.1.0 | No fix listed |
| pypi keystone(PyPI) | = 14.2.0 | No fix listed |
| pypi keystone(PyPI) | = 15.0.0 | No fix listed |
| pypi keystone(PyPI) | = 15.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 15.0.0.0rc2 | No fix listed |
| pypi keystone(PyPI) | = 15.0.1 | No fix listed |
| pypi keystone(PyPI) | = 16.0.0 | No fix listed |
| pypi keystone(PyPI) | = 16.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 16.0.0.0rc2 | No fix listed |
| pypi keystone(PyPI) | = 16.0.1 | No fix listed |
| pypi keystone(PyPI) | = 16.0.2 | No fix listed |
| pypi keystone(PyPI) | = 17.0.0 | No fix listed |
| pypi keystone(PyPI) | = 17.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 17.0.0.0rc2 | No fix listed |
| pypi keystone(PyPI) | = 17.0.1 | No fix listed |
| pypi keystone(PyPI) | = 18.0.0 | No fix listed |
| pypi keystone(PyPI) | = 18.0.0.0rc1 | No fix listed |
Show 47 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi keystone(PyPI) | = 18.1.0 | No fix listed |
| pypi keystone(PyPI) | = 19.0.0 | No fix listed |
| pypi keystone(PyPI) | = 19.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 19.0.0.0rc2 | No fix listed |
| pypi keystone(PyPI) | = 19.0.1 | No fix listed |
| pypi keystone(PyPI) | = 20.0.0 | No fix listed |
| pypi keystone(PyPI) | = 20.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 20.0.1 | No fix listed |
| pypi keystone(PyPI) | = 21.0.0 | No fix listed |
| pypi keystone(PyPI) | = 21.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 21.0.1 | No fix listed |
| pypi keystone(PyPI) | = 22.0.0 | No fix listed |
| pypi keystone(PyPI) | = 22.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 22.0.1 | No fix listed |
| pypi keystone(PyPI) | = 22.0.2 | No fix listed |
| pypi keystone(PyPI) | = 23.0.0 | No fix listed |
| pypi keystone(PyPI) | = 23.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 23.0.1 | No fix listed |
| pypi keystone(PyPI) | = 23.0.2 | No fix listed |
| pypi keystone(PyPI) | = 24.0.0 | No fix listed |
| pypi keystone(PyPI) | = 24.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 24.1.0 | No fix listed |
| pypi keystone(PyPI) | = 25.0.0 | No fix listed |
| pypi keystone(PyPI) | = 25.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 26.0.0 | No fix listed |
| pypi keystone(PyPI) | = 26.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 26.1.0 | No fix listed |
| pypi keystone(PyPI) | = 26.1.1 | No fix listed |
| pypi keystone(PyPI) | = 27.0.0 | No fix listed |
| pypi keystone(PyPI) | = 27.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 27.0.1 | No fix listed |
| pypi keystone(PyPI) | = 27.0.2 | No fix listed |
| pypi keystone(PyPI) | = 27.1.0 | No fix listed |
| pypi keystone(PyPI) | = 28.0.0 | No fix listed |
| pypi keystone(PyPI) | = 28.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 28.0.1 | No fix listed |
| pypi keystone(PyPI) | = 28.0.2 | No fix listed |
| pypi keystone(PyPI) | = 28.1.0 | No fix listed |
| pypi keystone(PyPI) | = 29.0.0 | No fix listed |
| pypi keystone(PyPI) | = 29.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 29.0.1 | No fix listed |
| pypi keystone(PyPI) | = 29.0.2 | No fix listed |
| pypi keystone(PyPI) | = 29.1.0 | No fix listed |
| debian/keystone(Debian:12) | < 2012.1.1-6 | 2012.1.1-6 |
| debian/keystone(Debian:13) | < 2012.1.1-6 | 2012.1.1-6 |
| debian/keystone(Debian:14) | < 2012.1.1-6 | 2012.1.1-6 |
| OpenStack Keystone | = 2012.1.3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- keystone-roles-sec-bypass(78478) vdb-entry
- [oss-security] 20120912 [OSSA 2012-014] Revoking a role does not affect existing tokens (CVE-2012-4413) mailing-list
- USN-1564-1 vendor-advisory
- access.redhat.com
- access.redhat.com
- bugs.launchpad.net
- bugzilla.redhat.com
- review.opendev.org
- web.archive.org
- github.com patch
- github.com vendor-advisory
- opendev.org product
- pypi.org product
- Debian Security Tracker CVE-2012-4413 vendor-advisory
- 85484 vdb-entry
- 50531 third-party-advisory vendor-advisory
- 50590 third-party-advisory vendor-advisory
- 55524 vdb-entry
- bugs.debian.org issue-tracking