CVE-2012-5563 OpenStack Keystone Insufficient token expiration
MediumCVSS 4.0
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi keystone(PyPI) | < 8.0.0 | 8.0.0 |
| pypi keystone(PyPI) | All versions | No fix listed |
| pypi keystone(PyPI) | = 12.0.2 | No fix listed |
| pypi keystone(PyPI) | = 12.0.3 | No fix listed |
| pypi keystone(PyPI) | = 13.0.2 | No fix listed |
| pypi keystone(PyPI) | = 13.0.3 | No fix listed |
| pypi keystone(PyPI) | = 13.0.4 | No fix listed |
| pypi keystone(PyPI) | = 14.0.0 | No fix listed |
| pypi keystone(PyPI) | = 14.0.1 | No fix listed |
| pypi keystone(PyPI) | = 14.1.0 | No fix listed |
| pypi keystone(PyPI) | = 14.2.0 | No fix listed |
| pypi keystone(PyPI) | = 15.0.0 | No fix listed |
| pypi keystone(PyPI) | = 15.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 15.0.0.0rc2 | No fix listed |
| pypi keystone(PyPI) | = 15.0.1 | No fix listed |
| pypi keystone(PyPI) | = 16.0.0 | No fix listed |
| pypi keystone(PyPI) | = 16.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 16.0.0.0rc2 | No fix listed |
| pypi keystone(PyPI) | = 16.0.1 | No fix listed |
| pypi keystone(PyPI) | = 16.0.2 | No fix listed |
| pypi keystone(PyPI) | = 17.0.0 | No fix listed |
| pypi keystone(PyPI) | = 17.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 17.0.0.0rc2 | No fix listed |
| pypi keystone(PyPI) | = 17.0.1 | No fix listed |
| pypi keystone(PyPI) | = 18.0.0 | No fix listed |
Show 48 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi keystone(PyPI) | = 18.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 18.1.0 | No fix listed |
| pypi keystone(PyPI) | = 19.0.0 | No fix listed |
| pypi keystone(PyPI) | = 19.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 19.0.0.0rc2 | No fix listed |
| pypi keystone(PyPI) | = 19.0.1 | No fix listed |
| pypi keystone(PyPI) | = 20.0.0 | No fix listed |
| pypi keystone(PyPI) | = 20.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 20.0.1 | No fix listed |
| pypi keystone(PyPI) | = 21.0.0 | No fix listed |
| pypi keystone(PyPI) | = 21.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 21.0.1 | No fix listed |
| pypi keystone(PyPI) | = 22.0.0 | No fix listed |
| pypi keystone(PyPI) | = 22.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 22.0.1 | No fix listed |
| pypi keystone(PyPI) | = 22.0.2 | No fix listed |
| pypi keystone(PyPI) | = 23.0.0 | No fix listed |
| pypi keystone(PyPI) | = 23.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 23.0.1 | No fix listed |
| pypi keystone(PyPI) | = 23.0.2 | No fix listed |
| pypi keystone(PyPI) | = 24.0.0 | No fix listed |
| pypi keystone(PyPI) | = 24.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 24.1.0 | No fix listed |
| pypi keystone(PyPI) | = 25.0.0 | No fix listed |
| pypi keystone(PyPI) | = 25.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 26.0.0 | No fix listed |
| pypi keystone(PyPI) | = 26.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 26.1.0 | No fix listed |
| pypi keystone(PyPI) | = 26.1.1 | No fix listed |
| pypi keystone(PyPI) | = 27.0.0 | No fix listed |
| pypi keystone(PyPI) | = 27.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 27.0.1 | No fix listed |
| pypi keystone(PyPI) | = 28.0.0 | No fix listed |
| pypi keystone(PyPI) | = 28.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 28.0.1 | No fix listed |
| pypi keystone(PyPI) | = 29.0.0 | No fix listed |
| pypi keystone(PyPI) | = 29.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 29.0.1 | No fix listed |
| pypi keystone(PyPI) | = grizzly-1 | No fix listed |
| pypi keystone(PyPI) | = folsom-rc2 | No fix listed |
| pypi keystone(PyPI) | = 2012.2 | No fix listed |
| pypi keystone(PyPI) | = folsom-rc1 | No fix listed |
| pypi keystone(PyPI) | = folsom-2 | No fix listed |
| pypi keystone(PyPI) | = folsom-1 | No fix listed |
| pypi keystone(PyPI) | = essex-rc1 | No fix listed |
| pypi keystone(PyPI) | = essex-4 | No fix listed |
| pypi keystone(PyPI) | = 2011.3 | No fix listed |
| OpenStack folsom | = 2012.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- bugs.launchpad.net
- folsom-tokens-security-bypass(80370) vdb-entry
- github.com product
- github.com
- web.archive.org
- web.archive.org
- web.archive.org
- RHSA-2012:1557 vendor-advisory
- [oss-security] 20121128 [OSSA 2012-018] EC2-style credentials invalidation issue (CVE-2012-5571) mailing-list patch
- [oss-security] 20121128 [OSSA 2012-019] Extension of token validity through token chaining (CVE-2012-5563) mailing-list patch
- USN-1641-1 vendor-advisory
- 51436 third-party-advisory vendor-advisory
- 51423 third-party-advisory vendor-advisory
- 56727 vdb-entry
- github.com vendor-advisory
- Debian Security Tracker CVE-2012-5563 vendor-advisory