Red Hat Security Advisory

RHSA-2012:1556

openstack-keystone security, bug fix, and enhancement update

Released 2012-12-10 · Red Hat rating Moderate · View on Red Hat →

Fixed in

RHOS Essex Release openstack-keystone-2012.1.3-3.el6, openstack-keystone-doc-2012.1.3-3.el6, python-keystone-2012.1.3-3.el6 +1

Fixes 2 records

TI-2012-04687 CVE-2012-5571 · GHSA-qvpr-qm6w-6rcc

Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling

LOW 28

A flaw was found in OpenStack Keystone.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.02047 Published 2012-12-18 Partial fix · 2012.1.3-3.el6, 2012.2.1-1.el6ost +1 CWE-639

TI-2012-04602 CVE-2012-5483 · GHSA-8cx8-xmvm-66wj

tools/sample_data.sh in OpenStack Keystone 2012.1.3, when access to Amazon Elastic…

LOW 11

tools/sample_data.sh in OpenStack Keystone 2012.1.3, when access to Amazon Elastic Compute Cloud (Amazon EC2) is configured, uses world-readable permissions for /etc/keystone/ec2rc, which allows local users to obtain acc…

CVSS 2.0LOW 2.1 Local No auth Interaction — EPSS 0.00341 Published 2012-12-26 Fixed CWE-264