CVE-2012-5571 Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling
Remote authenticated users can bypass authorization restrictions in OpenStack Keystone by exploiting improper EC2 token handling after role removal.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-5571?
CVE-2012-5571 is a medium-severity authentication bypass vulnerability in Red Hat OpenStack Platform 13 (Queens), published on 18 Dec 2012. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.
Which versions are affected by CVE-2012-5571?
2 open source packages ship an affected version, including Keystone and keystone. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
Keystone PyPI | All versions | 8.0.0a0 |
keystone PyPI | All versions | 8.0.0a0 |
Products include Openstack Essex, Openstack Folsom.
How do I fix CVE-2012-5571?
Upgrade Keystone to 8.0.0a0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2012-5571 being exploited?
There is no known exploitation of CVE-2012-5571 in the wild and no public exploit code.
Other vulnerabilities in Red Hat OpenStack Platform 13 (Queens)
- CVE-2013-0261 Packstack: packstack: arbitrary file overwrite via symlink attack
- CVE-2013-0266 Information disclosure in Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)
- CVE-2012-4573 OpenStack Glance arbitrary deletion of non-protected images
- CVE-2012-5482 OpenStack Glance arbitrary deletion of non-protected images
- CVE-2012-3360 OpenStack Nova Directory traversal vulnerability
Sources
Also known as DEBIAN-CVE-2012-5571, GHSA-qvpr-qm6w-6rcc.