CVE-2012-5563: OpenStack Keystone Insufficient token… – CVSS 4.0 · Watchpost

← All vulnerabilities

OpenStack Keystone Insufficient token expiration

보통 4.0CVE-2012-5563 · GHSA-w66p-78g4-mr7g · PYSEC-2012-20 · Published 18/12/2012 · updated 16/06/2026

요약

CVE-2012-5563은(는) keystone, folsom (openstack)에 영향을 주는 보통 (CVSS 4.0) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 2.9%, 전체 취약점의 86.8%보다 높음.
조치: 8.0.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
keystone PyPI	`< 8.0.0all versions`	`8.0.0`
folsom openstack	`= 2012.2`	No fix yet

Description

OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.

NVD description

OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.

References

nvd.nist.gov/vuln/detail/CVE-2012-5563 · ADVISORY
openstack/keystone commit 38c7e46 · WEB
openstack/keystone commit f9d4766 · WEB
bugs.launchpad.net/keystone/+bug/1079216 · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/80370 · WEB
openstack/keystone · PACKAGE
pypa/advisory-database · WEB
web.archive.org/web/20121201003009/http://secunia.com/advisories/51423 · WEB
web.archive.org/web/20140802122732/http://secunia.com/advisories/51436 · WEB
web.archive.org/web/20200228144943/http://www.securityfocus.com/bid/56727 · WEB
rhn.redhat.com/errata/RHSA-2012-1557.html

keystone의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free