CVE-2012-5571

2012-11-2800:00:00

ubuntu.com

0.003 Low

EPSS

Percentile

66.1%

JSON

OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly
handle EC2 tokens when the user role has been removed from a tenant, which
allows remote authenticated users to bypass intended authorization
restrictions by leveraging a token for the removed user role.

Bugs

<https://bugs.launchpad.net/keystone/+bug/1064914>

Notes

Author	Note
jdstrand	Keystone on 11.10 is a pre-release version and unusable with other components such as nova and horizon

OSVersionArchitecturePackageVersionFilename
ubuntu12.04noarchkeystone< 2012.1+stable~20120824-a16a0ab9-0ubuntu2.3UNKNOWN
ubuntu12.10noarchkeystone< 2012.2-0ubuntu1.2UNKNOWN