CVE-2020-12692
CVE-2020-12692
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.
CVSS 5.4 · Medium · EPSS 0.7% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
keystone Debian:12
- Affected ranges
- ECOSYSTEM: < 2:17.0.0~rc2-1
Update to 2:17.0.0~rc2-1
keystone Debian:13
- Affected ranges
- ECOSYSTEM: < 2:17.0.0~rc2-1
Update to 2:17.0.0~rc2-1
keystone Debian:14
- Affected ranges
- ECOSYSTEM: < 2:17.0.0~rc2-1
Update to 2:17.0.0~rc2-1
keystone PyPI
- Versions
- 16.0.0.0rc1
- 16.0.0.0rc2
- Affected ranges
- ECOSYSTEM: ≥ 16.0.0.0rc1, < 16.0.0
Update to 16.0.0
keystone PyPI
- Versions
- 12.0.2
- 12.0.3
- 13.0.2
- 13.0.3
- 13.0.4
- 14.0.0
- 14.0.1
- 14.1.0
- 14.2.0
- 15.0.0
- 15.0.0.0rc1
- 15.0.0.0rc2
- Affected ranges
- ECOSYSTEM: < 15.0.1
Update to 15.0.1
keystone Ubuntu:Pro:16.04:LTS
- Versions
- 2:8.0.0-0ubuntu1
- 2:9.0.0~b1-0ubuntu1
- 2:9.0.0~b2-0ubuntu1
- 2:9.0.0~b3-0ubuntu1
- 2:9.0.0~rc1-0ubuntu1
- 2:9.0.0-0ubuntu1
- 2:9.0.2-0ubuntu1
- 2:9.0.2-0ubuntu2
- 2:9.1.0-0ubuntu1
- 2:9.2.0-0ubuntu1
- 2:9.3.0-0ubuntu1
- 2:9.3.0-0ubuntu2
- 2:9.3.0-0ubuntu3
- 2:9.3.0-0ubuntu3.1
- 2:9.3.0-0ubuntu3.2
- 2:9.3.0-0ubuntu3.2+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
keystone Ubuntu:18.04:LTS
- Versions
- 2:12.0.0-0ubuntu1
- 2:13.0.0~b1-0ubuntu1
- 2:13.0.0~b2-0ubuntu1
- 2:13.0.0~b3-0ubuntu1
- 2:13.0.0~rc1-0ubuntu1
- 2:13.0.0~rc2-0ubuntu1
- 2:13.0.0-0ubuntu1
- 2:13.0.1-0ubuntu1
- 2:13.0.2-0ubuntu1
- 2:13.0.2-0ubuntu3
- Affected ranges
- ECOSYSTEM: < 2:13.0.4-0ubuntu1
Update to 2:13.0.4-0ubuntu1