OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token…
Priority LOW 24CWE-255Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.
Summary
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
Why it matters now
EPSS 0.02919 87th percentileScored 2026-11-07
Fix Fixed keystone (PyPI): 8.0.0Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | keystone (PyPI) | before 8.0.0 | 8.0.0 | Patch available | GHSA-w66p-78g4-mr7g |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- keystone (PyPI) Vendor— Affected before 8.0.0 Fixed in 8.0.0 Patch available GHSA-w66p-78g4-mr7g
Remediation
- Fix · GHSA-w66p-78g4-mr7g keystone (PyPI) Fixed in 8.0.0 Advisory →
Red Hat 1 advisory
- RHSA-2012:1557 Released 2012-12-10 · Red Hat rating Moderateopenstack-keystone security, bug fix, and enhancement update
- OpenStack Folsom openstack-keystone-2012.2.1-1.el6ost, openstack-keystone-doc-2012.2.1-1.el6ost, python-keystone-2012.2.1-1.el6ost
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenStack Folsom | Fixed | RHSA-2012:1557 |
Timeline
- 2026-10-02 Threatist record created from CVE-2012-5563
- 2026-10-03 Alias added: GHSA-w66p-78g4-mr7g
References
Patch 2
Other 8
- https://github.com/openstack/keystone/commit/38c7e46a640a94da4da89a39a5a1ea9c081f1eb5
- https://github.com/openstack/keystone/commit/f9d4766249a72d8f88d75dcf1575b28dd3496681
- https://bugs.launchpad.net/keystone/+bug/1079216
- https://github.com/openstack/keystone
- https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2012-20.yaml
- https://web.archive.org/web/20121201003009/http://secunia.com/advisories/51423
- https://web.archive.org/web/20140802122732/http://secunia.com/advisories/51436
- https://web.archive.org/web/20200228144943/http://www.securityfocus.com/bid/56727
More OpenStack Folsom vulnerabilities
- TI-2013-00195 Packstack: packstack: arbitrary file overwrite via symlink attack CVSS 3.1HIGH 8.8
- TI-2013-01930 XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and… CVSS 2.0HIGH 7.5
- TI-2013-00265 Openstack nova: vnc proxy can connect to the wrong vm CVSS 3.1HIGH 7.6
- TI-2013-01648 OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for… CVSS 2.0MEDIUM 6.8
- TI-2013-00142 The boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using… CVSS 2.0MEDIUM 6.5
- TI-2013-03945 The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2… CVSS 2.0MEDIUM 6.4
Sources
- CVE-2012-5563 · CVE Program
- CVE-2012-5563 · NVD
- FIRST EPSS
- GHSA-w66p-78g4-mr7g · GitHub Advisory Database · CC BY 4.0
- CVE-2012-5563 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences