CVE-2012-5563
Description
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2012-5563
Vendor advisory: secalert@redhat.com — http://www.openwall.com/lists/oss-security/2012/11/28/6
Vendor advisory: secalert@redhat.com — http://www.openwall.com/lists/oss-security/2012/11/28/5
Vendor advisory: secalert@redhat.com — http://secunia.com/advisories/51436
Vendor advisory: secalert@redhat.com — http://secunia.com/advisories/51423
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | fixed | 0 |
| debian | bullseye | fixed | 0 |
| debian | forky | fixed | 0 |
| debian | sid | fixed | 0 |
| debian | trixie | fixed | 0 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| openstack | folsom | 2012.2 | |
References
- http://rhn.redhat.com/errata/RHSA-2012-1557.html
- http://secunia.com/advisories/51423
- http://secunia.com/advisories/51436
- http://www.openwall.com/lists/oss-security/2012/11/28/5
- http://www.openwall.com/lists/oss-security/2012/11/28/6
- http://www.securityfocus.com/bid/56727
- http://www.ubuntu.com/usn/USN-1641-1
- https://bugs.launchpad.net/keystone/+bug/1079216
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80370
- https://github.com/openstack/keystone/commit/38c7e46a640a94da4da89a39a5a1ea9c081f1eb5
- https://github.com/openstack/keystone/commit/f9d4766249a72d8f88d75dcf1575b28dd3496681
- https://nvd.nist.gov/vuln/detail/CVE-2012-5563
- https://github.com/openstack/keystone
- https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2012-20.yaml
- https://web.archive.org/web/20121201003009/http://secunia.com/advisories/51423
- https://web.archive.org/web/20140802122732/http://secunia.com/advisories/51436
- https://web.archive.org/web/20200228144943/http://www.securityfocus.com/bid/56727
- https://security-tracker.debian.org/tracker/CVE-2012-5563
CWEs
CWE-255
Verify integrity in audit chain (admin only). AS-IS.