In short
- CVE-2012-5571 is a MEDIUM (CVSS 5.4) vulnerability affecting keystone, essex (openstack), folsom (openstack).
- Chance of exploitation in the next 30 days (EPSS): 2.1%, higher than 81.3% of all vulnerabilities.
- Fix: update to 8.0.0a0 or later.
| Package | Affected versions | Patched versions |
|---|
| keystone PyPI | < 8.0.0a0all versions
| 8.0.0a0
|
| essex | = 2012.1
| No fix yet |
| folsom | = 2012.2
| No fix yet |
Description
OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.
NVD description
A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free