Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS14cDk3LTZ3N3ItNGNqY84AAfhl

OpenStack Keystone token expiration issues

OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by (1) creating new tokens through token chaining, (2) leveraging possession of a token for a disabled user account, or (3) leveraging possession of a token for an account with a changed password.

Permalink: https://github.com/advisories/GHSA-xp97-6w7r-4cjc
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14cDk3LTZ3N3ItNGNqY84AAfhl
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: about 2 months ago

EPSS Percentage: 0.00205
EPSS Percentile: 0.58175

Identifiers: GHSA-xp97-6w7r-4cjc, CVE-2012-3426
References:

• https://nvd.nist.gov/vuln/detail/CVE-2012-3426
• https://bugs.launchpad.net/keystone/+bug/996595
• https://bugs.launchpad.net/keystone/+bug/997194
• https://bugs.launchpad.net/keystone/+bug/998185
• https://launchpad.net/keystone/essex/2012.1.1/+download/keystone-2012.1.1.tar.gz
• http://github.com/openstack/keystone/commit/29e74e73a6e51cffc0371b32354558391826a4aa
• http://github.com/openstack/keystone/commit/375838cfceb88cacc312ff6564e64eb18ee6a355
• http://github.com/openstack/keystone/commit/628149b3dc6b58b91fd08e6ca8d91c728ccb8626
• http://github.com/openstack/keystone/commit/a67b24878a6156eab17b9098fa649f0279256f5d
• http://github.com/openstack/keystone/commit/d9600434da14976463a0bd03abd8e0309f0db454
• http://github.com/openstack/keystone/commit/ea03d05ed5de0c015042876100d37a6a14bf56de
• http://www.openwall.com/lists/oss-security/2012/07/27/4
• http://www.ubuntu.com/usn/USN-1552-1
• https://github.com/openstack/keystone/commit/375838cfceb88cacc312ff6564e64eb18ee6a355
• https://github.com/openstack/keystone/commit/628149b3dc6b58b91fd08e6ca8d91c728ccb8626
• https://github.com/openstack/keystone/commit/a67b24878a6156eab17b9098fa649f0279256f5d
• https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2012-34.yaml
• https://github.com/advisories/GHSA-xp97-6w7r-4cjc

Repository: https://github.com/openstack/keystone
Blast Radius: 0.0

Affected Packages