CVE-2012-3426
CVE-2012-3426
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by (1) creating new tokens through token chaining, (2) leveraging possession of a token for a disabled user account, or (3) leveraging possession of a token for an account with a changed password.
EPSS 2.3% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
keystone Debian:12
- Affected ranges
- ECOSYSTEM: < 2012.1.1-1
Update to 2012.1.1-1
keystone Debian:13
- Affected ranges
- ECOSYSTEM: < 2012.1.1-1
Update to 2012.1.1-1
keystone Debian:14
- Affected ranges
- ECOSYSTEM: < 2012.1.1-1
Update to 2012.1.1-1
keystone PyPI
- Affected ranges
- ECOSYSTEM: < 8.0.0a0
Update to 8.0.0a0
Original sources
- http://github.com/openstack/keystone/commit/d9600434da14976463a0bd03abd8e0309f0db454
- http://github.com/openstack/keystone/commit/29e74e73a6e51cffc0371b32354558391826a4aa
- https://bugs.launchpad.net/keystone/+bug/998185
- https://bugs.launchpad.net/keystone/+bug/997194
- https://launchpad.net/keystone/essex/2012.1.1/+download/keystone-2012.1.1.tar.gz
- http://secunia.com/advisories/50494
- http://github.com/openstack/keystone/commit/ea03d05ed5de0c015042876100d37a6a14bf56de
- https://bugs.launchpad.net/keystone/+bug/996595
- http://www.openwall.com/lists/oss-security/2012/07/27/4
- http://github.com/openstack/keystone/commit/628149b3dc6b58b91fd08e6ca8d91c728ccb8626
- http://www.ubuntu.com/usn/USN-1552-1
- http://github.com/openstack/keystone/commit/375838cfceb88cacc312ff6564e64eb18ee6a355
- http://github.com/openstack/keystone/commit/a67b24878a6156eab17b9098fa649f0279256f5d
- http://secunia.com/advisories/50045
- https://nvd.nist.gov/vuln/detail/CVE-2012-3426