CVE-2013-0282 OpenStack Keystone allows context-dependent attackers to bypass access restrictions
MediumCVSS 5.0
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi keystone(PyPI) | < 8.0.0a0 | 8.0.0a0 |
| debian/keystone(Debian:12) | < 2012.1.1-13 | 2012.1.1-13 |
| debian/keystone(Debian:13) | < 2012.1.1-13 | 2012.1.1-13 |
| debian/keystone(Debian:14) | < 2012.1.1-13 | 2012.1.1-13 |
| OpenStack Keystone | >= 2012.1, <= 2012.1.3 | No fix listed |
| OpenStack Keystone | >= 2012.2, <= 2012.2.4 | No fix listed |
| OpenStack Keystone | = 2013.1-milestone1 | No fix listed |
| OpenStack Keystone | = 2013.1-milestone2 | No fix listed |
| OpenStack Keystone | = 2013.1-milestone3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- bugs.launchpad.net third-party-advisory
- launchpad.net third-party-advisory
- launchpad.net third-party-advisory
- review.openstack.org vendor-advisory
- [oss-security] 20130219 [OSSA 2013-005] Keystone EC2-style authentication accepts disabled user/tenants (CVE-2013-0282) mailing-list third-party-advisory
- pypi.org product
- github.com vendor-advisory
- Debian Security Tracker CVE-2013-0282 vendor-advisory
- bugs.debian.org issue-tracking