GitHub Advisoryadvisory · PyPI
GHSA-8833-qrvm-wc3h OpenStack Keystone allows context-dependent attackers to bypass access restrictions
MEDIUM
Official page ↗
- Aliases
- CVE-2013-0282
- Ecosystem
- PyPI
- Packages
- Keystone
- Severity
- Moderate
- Weaknesses
- CWE-287
- Reviewed
- 2024-05-09
Affected packages
• PyPI Keystone: < 8.0.0a0 → fixed in 8.0.0a0
Description
OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.
Related
Alias · CVE (1)
- CVE-2013-0282 OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or… vulnerability
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-0282 advisory
- https://github.com/openstack/keystone/commit/7402f5ef994599653bdbb3ed5ff1a2b8c3e72b9f web
- https://github.com/openstack/keystone/commit/9572bfc393f66f5ce3b44c0a77a9e29cc0374c6f web
- https://github.com/openstack/keystone/commit/f0b4d300db5cc61d4f079f8bce9da8e8bea1081a web
- https://bugs.launchpad.net/keystone/+bug/1121494 web
- https://launchpad.net/keystone/+milestone/2012.2.4 web
- https://launchpad.net/keystone/grizzly/2013.1 web
- https://review.openstack.org/#/c/22319 web
- https://review.openstack.org/#/c/22320 web
- https://review.openstack.org/#/c/22321 web
- http://www.openwall.com/lists/oss-security/2013/02/19/3 web