CVE-2012-3542
CVE-2012-3542
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.
CVSS 7.5 · High · EPSS 2.5% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
keystone Debian:12
- Affected ranges
- ECOSYSTEM: < 2012.1.1-5
Update to 2012.1.1-5
keystone Debian:13
- Affected ranges
- ECOSYSTEM: < 2012.1.1-5
Update to 2012.1.1-5
keystone Debian:14
- Affected ranges
- ECOSYSTEM: < 2012.1.1-5
Update to 2012.1.1-5
keystone PyPI
- Versions
- 12.0.2
- 12.0.3
- 13.0.2
- 13.0.3
- 13.0.4
- 14.0.0
- 14.0.1
- 14.1.0
- 14.2.0
- 15.0.0
- 15.0.0.0rc1
- 15.0.0.0rc2
- 15.0.1
- 16.0.0
- 16.0.0.0rc1
- 16.0.0.0rc2
- 16.0.1
- 16.0.2
- 17.0.0
- 17.0.0.0rc1
- 17.0.0.0rc2
- 17.0.1
- 18.0.0
- 18.0.0.0rc1
- 18.1.0
- 19.0.0
- 19.0.0.0rc1
- 19.0.0.0rc2
- 19.0.1
- 20.0.0
- 20.0.0.0rc1
- 20.0.1
- 21.0.0
- 21.0.0.0rc1
- 21.0.1
- 22.0.0
- 22.0.0.0rc1
- 22.0.1
- 22.0.2
- 23.0.0
- 23.0.0.0rc1
- 23.0.1
- 23.0.2
- 24.0.0
- 24.0.0.0rc1
- 24.1.0
- 25.0.0
- 25.0.0.0rc1
- 26.0.0
- 26.0.0.0rc1
- 26.1.0
- 26.1.1
- 27.0.0
- 27.0.0.0rc1
- 27.0.1
- 27.0.2
- 27.1.0
- 28.0.0
- 28.0.0.0rc1
- 28.0.1
- 28.0.2
- 28.1.0
- 29.0.0
- 29.0.0.0rc1
- 29.0.1
- 29.0.2
- 29.1.0
- Affected ranges
- ECOSYSTEM: < 2012.1
Update to 2012.1
keystone PyPI
- Versions
- 12.0.2
- 12.0.3
- 13.0.2
- 13.0.3
- 13.0.4
- 14.0.0
- 14.0.1
- 14.1.0
- 14.2.0
- 15.0.0
- 15.0.0.0rc1
- 15.0.0.0rc2
- 15.0.1
- 16.0.0
- 16.0.0.0rc1
- 16.0.0.0rc2
- 16.0.1
- 16.0.2
- 17.0.0
- 17.0.0.0rc1
- 17.0.0.0rc2
- 17.0.1
- 18.0.0
- 18.0.0.0rc1
- 18.1.0
- 19.0.0
- 19.0.0.0rc1
- 19.0.0.0rc2
- 19.0.1
- 20.0.0
- 20.0.0.0rc1
- 20.0.1
- 21.0.0
- 21.0.0.0rc1
- 21.0.1
- 22.0.0
- 22.0.0.0rc1
- 22.0.1
- 22.0.2
- 23.0.0
- 23.0.0.0rc1
- 23.0.1
- 23.0.2
- 24.0.0
- 24.0.0.0rc1
- 24.1.0
- 25.0.0
- 25.0.0.0rc1
- 26.0.0
- 26.0.0.0rc1
- 26.1.0
- 26.1.1
- 27.0.0
- 27.0.0.0rc1
- 27.0.1
- 28.0.0
- 28.0.0.0rc1
- 28.0.1
- 29.0.0
- 29.0.0.0rc1
- 29.0.1
- 2012.1.2
- folsom-2
- 2012.1.1
- folsom-1
- essex-rc2
- 2012.1
- essex-rc1
- essex-4
- 2011.3
- Affected ranges
- {"events": [{"introduced": "0"}, {"fixed": "5438d3b5a219d7c8fa67e66e538d325a61617155"}, {"fixed": "c13d0ba606f7b2bdc609a7f388334e5efec3f3aa"}], "repo": "https://github.com/openstack/keystone", "type": "GIT"}
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- http://secunia.com/advisories/50467
- http://www.securityfocus.com/bid/55326
- https://lists.launchpad.net/openstack/msg16282.html
- https://github.com/openstack/keystone/commit/c13d0ba606f7b2bdc609a7f388334e5efec3f3aa
- http://www.openwall.com/lists/oss-security/2012/08/30/6
- https://github.com/openstack/keystone/commit/5438d3b5a219d7c8fa67e66e538d325a61617155
- http://secunia.com/advisories/50494
- https://bugs.launchpad.net/keystone/+bug/1040626
- http://www.ubuntu.com/usn/USN-1552-1
- https://nvd.nist.gov/vuln/detail/CVE-2012-3542