Kurz gesagt
- CVE-2012-5571 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in keystone, essex (openstack), folsom (openstack).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.1%, höher als bei 81.3% aller Schwachstellen.
- Abhilfe: auf 8.0.0a0 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| keystone PyPI | < 8.0.0a0all versions
| 8.0.0a0
|
| essex | = 2012.1
| No fix yet |
| folsom | = 2012.2
| No fix yet |
Description
OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.
NVD description
A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free