Read the docs
Red Hat Security Advisory

RHSA-2012:1378

openstack-keystone security update

Released 2012-10-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 4 records

TI-2012-03798 CVE-2012-4456 · GHSA-mf98-r2gf-2x3w

The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2…

Priority MEDIUM 40

The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03998 Published 2012-10-09 Fixed in 2012.1.2 CWE-287
TI-2012-03068 CVE-2012-3542 · GHSA-gf2q-j2qq-pjf2

OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex…

Priority LOW 25

OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02491 Published 2012-09-05 Fixed in 2012.1 CWE-264
TI-2012-03799 CVE-2012-4457 · GHSA-x8h4-xf47-pqc3

OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly…

Priority LOW 23

OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesti…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.02286 Published 2012-10-09 Fixed in 8.0.0a0 CWE-287