Red Hat Security Advisory

RHSA-2012:1557

openstack-keystone security, bug fix, and enhancement update

Released 2012-12-10 · Red Hat rating Moderate · View on Red Hat →

Fixed in

OpenStack Folsom openstack-keystone-2012.2.1-1.el6ost, openstack-keystone-doc-2012.2.1-1.el6ost, python-keystone-2012.2.1-1.el6ost

Fixes 2 records

TI-2012-04687 CVE-2012-5571 · GHSA-qvpr-qm6w-6rcc

Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling

LOW 28

A flaw was found in OpenStack Keystone.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.02047 Published 2012-12-18 Partial fix · 2012.1.3-3.el6, 2012.2.1-1.el6ost +1 CWE-639

TI-2012-04679 CVE-2012-5563 · GHSA-w66p-78g4-mr7g

OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token…

LOW 24

OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through t…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.02919 Published 2012-12-18 Fixed in 8.0.0 CWE-255