Em resumo
- CVE-2012-5571 é uma vulnerabilidade MÉDIO (CVSS 5.4) que afeta keystone, essex (openstack), folsom (openstack).
- Chance de exploração nos próximos 30 dias (EPSS): 2.1%, maior que 81.3% das vulnerabilidades.
- Correção: atualize para 8.0.0a0 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| keystone PyPI | < 8.0.0a0all versions
| 8.0.0a0
|
| essex | = 2012.1
| No fix yet |
| folsom | = 2012.2
| No fix yet |
Description
OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.
NVD description
A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free