Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS14cDk3LTZ3N3ItNGNqY84AAfhl

OpenStack Keystone token expiration issues

OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by (1) creating new tokens through token chaining, (2) leveraging possession of a token for a disabled user account, or (3) leveraging possession of a token for an account with a changed password.

Permalink: https://github.com/advisories/GHSA-xp97-6w7r-4cjc
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14cDk3LTZ3N3ItNGNqY84AAfhl
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 4 months ago


Identifiers: GHSA-xp97-6w7r-4cjc, CVE-2012-3426
References: Repository: https://github.com/openstack/keystone
Blast Radius: 0.0

Affected Packages

pypi:Keystone
Dependent packages: 3
Dependent repositories: 37
Downloads: 5,716 last month
Affected Version Ranges: < 8.0.0a0
Fixed in: 8.0.0a0
All affected versions:
All unaffected versions: 12.0.2, 12.0.3, 13.0.2, 13.0.3, 13.0.4, 14.0.0, 14.0.1, 14.1.0, 14.2.0, 15.0.0, 15.0.1, 16.0.0, 16.0.1, 16.0.2, 17.0.0, 17.0.1, 18.0.0, 18.1.0, 19.0.0, 19.0.1, 20.0.0, 20.0.1, 21.0.0, 21.0.1, 22.0.0, 22.0.1, 22.0.2, 23.0.0, 23.0.1, 24.0.0, 25.0.0