Lucene search
Ubuntu.comUB:CVE-2012-3426HistoryJul 27, 2012 - 12:00 a.m.
CVE-2012-3426
2012-07-2700:00:00
ubuntu.com
ubuntu.com
8
0.003 Low
EPSS
Percentile
65.0%
OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before
Folsom-1 and OpenStack Essex, does not properly implement token expiration,
which allows remote authenticated users to bypass intended authorization
restrictions by (1) creating new tokens through token chaining, (2)
leveraging possession of a token for a disabled user account, or (3)
leveraging possession of a token for an account with a changed password.
Bugs
- <https://bugs.launchpad.net/keystone/+bug/998185>
- <https://bugs.launchpad.net/keystone/+bug/997194>
- <https://bugs.launchpad.net/keystone/+bug/996595>
Notes
| Author | Note |
|---|---|
| tyhicks | Fixed in Keystone 2012.1.1 stable update and the Folsom-1 development milestone |
| jdstrand | Keystone on 11.10 is a pre-release version and unusable with other components such as nova and horizon |
Related
cve
cve
CVE-2012-3426
2012-07-31 10:45:00
CVE-2012-5563
2012-12-18 01:55:00
osv
osv
OpenStack Keystone token expiration issues
2022-05-17 05:23:24
OpenStack Keystone Insufficient token expiration
2022-05-17 01:39:21
prion
prion
Authorization
2012-07-31 10:45:00
Authorization
2012-12-18 01:55:00
cvelist
cvelist
CVE-2012-3426
2012-07-31 10:00:00
CVE-2012-5563
2012-12-18 01:00:00
debiancve
debiancve
CVE-2012-3426
2012-07-31 10:45:00
CVE-2012-5563
2012-12-18 01:55:00
github
github
OpenStack Keystone token expiration issues
2022-05-17 05:23:24
OpenStack Keystone Insufficient token expiration
2022-05-17 01:39:21
securityvulns
securityvulns
OpenStack Keystone limitations bypass
2012-09-03 00:00:00
[USN-1552-1] OpenStack Keystone vulnerabilities
2012-09-03 00:00:00
[USN-1641-1] OpenStack Keystone vulnerabilities
2012-12-10 00:00:00
nessus
nessus
Ubuntu 12.04 LTS : keystone vulnerabilities (USN-1552-1)
2012-09-04 00:00:00
Ubuntu 12.04 LTS / 12.10 : keystone vulnerabilities (USN-1641-1)
2012-11-29 00:00:00
ubuntucve
ubuntucve
CVE-2012-5563
2012-11-28 00:00:00
openvas
openvas
Ubuntu: Security Advisory (USN-1552-1)
2012-09-04 00:00:00
Ubuntu Update for keystone USN-1552-1
2012-09-04 00:00:00
Ubuntu: Security Advisory (USN-1641-1)
2012-11-29 00:00:00
ubuntu
ubuntu
OpenStack Keystone vulnerabilities
2012-09-03 00:00:00
OpenStack Keystone vulnerabilities
2012-11-28 00:00:00
fedora
fedora
[SECURITY] Fedora 17 Update: openstack-keystone-2012.1.2-4.fc17
2012-10-03 23:54:46
[SECURITY] Fedora 17 Update: openstack-keystone-2012.1.3-3.fc17
2012-12-11 01:27:24