CVE-2012-5571

OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
3.5 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:S/C:N/I:P/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 54%
VendorProductVersion
openstackessex
2012.1
openstackfolsom
2012.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
keystone
bullseye
2:18.0.0-3+deb11u1
fixed
bookworm
2:22.0.0-2
fixed
sid
2:26.0.0-1
fixed
trixie
2:26.0.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
keystone
quantal
Fixed 2012.2-0ubuntu1.2
released
precise
Fixed 2012.1+stable~20120824-a16a0ab9-0ubuntu2.3
released
oneiric
ignored
lucid
dne
hardy
dne
Common Weakness Enumeration
References
http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html
http://rhn.redhat.com/errata/RHSA-2012-1556.html
http://rhn.redhat.com/errata/RHSA-2012-1557.html
http://secunia.com/advisories/51423
http://secunia.com/advisories/51436
http://www.openwall.com/lists/oss-security/2012/11/28/5
http://www.openwall.com/lists/oss-security/2012/11/28/6
http://www.securityfocus.com/bid/56726
http://www.ubuntu.com/usn/USN-1641-1
https://bugs.launchpad.net/keystone/+bug/1064914
https://exchange.xforce.ibmcloud.com/vulnerabilities/80333
https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b
https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19
https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653
http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html
http://rhn.redhat.com/errata/RHSA-2012-1556.html
http://rhn.redhat.com/errata/RHSA-2012-1557.html
http://secunia.com/advisories/51423
http://secunia.com/advisories/51436
http://www.openwall.com/lists/oss-security/2012/11/28/5
http://www.openwall.com/lists/oss-security/2012/11/28/6
http://www.securityfocus.com/bid/56726
http://www.ubuntu.com/usn/USN-1641-1
https://bugs.launchpad.net/keystone/+bug/1064914
https://exchange.xforce.ibmcloud.com/vulnerabilities/80333
https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b
https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19
https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653