CVE-2012-5563 OpenStack Keystone Insufficient token expiration

Medium 4.0 Published 18 Dec 2012 Updated 6 Aug 2024

Authenticated users can bypass authorization restrictions by chaining expired tokens to create new valid ones in OpenStack Keystone.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2012-5563?

CVE-2012-5563 is a medium-severity authentication bypass vulnerability in n/a, published on 18 Dec 2012. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.

Weakness: CWE-255

Which versions are affected by CVE-2012-5563?

3 open source packages ship an affected version, including keystone. It affects 1 product.

Package	Affected	Fixed in
`keystone` PyPI	All versions	None
`keystone` PyPI	All versions	`8.0.0`
`keystone` PyPI	All versions	`8.0.0`

Linux distribution packages (3)

`openstack-keystone` Red Hat:openstack:2::el6	All versions	`0:2012.2.1-1.el6ost`
`openstack-keystone-doc` Red Hat:openstack:2::el6	All versions	`0:2012.2.1-1.el6ost`
`python-keystone` Red Hat:openstack:2::el6	All versions	`0:2012.2.1-1.el6ost`

Products include Openstack Folsom.

How do I fix CVE-2012-5563?

Upgrade keystone to 8.0.0 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2012-5563 being exploited?

There is no known exploitation of CVE-2012-5563 in the wild and no public exploit code.

Sources

Also known as GHSA-w66p-78g4-mr7g, PYSEC-2012-20, RHSA-2012:1557.