National Cyber Awareness System

Vulnerability Summary for CVE-2012-5571

Overview

OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653

Type: Patch Information

Hyperlink:https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653

External Source: CONFIRM

Name: https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19

Type: Patch Information

Hyperlink:https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19

External Source: CONFIRM

Name: https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b

Type: Patch Information

Hyperlink:https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b

External Source: CONFIRM

Name: https://bugs.launchpad.net/keystone/+bug/1064914

Type: Patch Information

Hyperlink:https://bugs.launchpad.net/keystone/+bug/1064914

External Source: MLIST

Name: [oss-security] 20121128 [OSSA 2012-019] Extension of token validity through token chaining (CVE-2012-5563)

Type: Patch Information

Hyperlink:http://www.openwall.com/lists/oss-security/2012/11/28/6

External Source: MLIST

Name: [oss-security] 20121128 [OSSA 2012-018] EC2-style credentials invalidation issue (CVE-2012-5571)

Type: Patch Information

Hyperlink:http://www.openwall.com/lists/oss-security/2012/11/28/5

External Source: XF

Name: keystone-tenant-sec-bypass(80333)

Hyperlink:http://xforce.iss.net/xforce/xfdb/80333

External Source: UBUNTU

Name: USN-1641-1

Hyperlink:http://www.ubuntu.com/usn/USN-1641-1

External Source: BID

Name: 56726

Hyperlink:http://www.securityfocus.com/bid/56726

External Source: SECUNIA

Name: 51436

Type: Advisory

Hyperlink:http://secunia.com/advisories/51436

External Source: SECUNIA

Name: 51423

Type: Advisory

Hyperlink:http://secunia.com/advisories/51423

External Source: REDHAT

Name: RHSA-2012:1557

Hyperlink:http://rhn.redhat.com/errata/RHSA-2012-1557.html

External Source: REDHAT

Name: RHSA-2012:1556

Hyperlink:http://rhn.redhat.com/errata/RHSA-2012-1556.html

External Source: FEDORA

Name: FEDORA-2012-19341

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html