GitHub Advisoryadvisory · PyPI
GHSA-mrxv-65rv-6hxq OpenStack Keystone does not invalidate existing tokens when granting or revoking roles
MEDIUM
Official page ↗
- Aliases
- CVE-2012-4413
- Ecosystem
- PyPI
- Packages
- keystone
- Severity
- Moderate
- Reviewed
- 2023-02-08
Affected packages
• PyPI keystone: < 2012.1.3 → fixed in 2012.1.3
Description
OpenStack Keystone before 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
Related
Alias · CVE (1)
- CVE-2012-4413 OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2012-4413 advisory
- https://access.redhat.com/errata/RHSA-2012:1378 web
- https://access.redhat.com/security/cve/CVE-2012-4413 web
- https://bugs.launchpad.net/keystone/+bug/1041396 web
- https://bugzilla.redhat.com/show_bug.cgi?id=855491 web
- https://exchange.xforce.ibmcloud.com/vulnerabilities/78478 web
- https://opendev.org/openstack/keystone package
- https://review.opendev.org/c/openstack/keystone/+/12870 web
- https://web.archive.org/web/20121114023848/http://www.securityfocus.com/bid/55524 web
- http://github.com/openstack/keystone/commit/58ac6691a21675be9e2ffb0f84a05fc3cd4d2e2e web
- http://www.openwall.com/lists/oss-security/2012/09/12/7 web
- http://www.ubuntu.com/usn/USN-1564-1 web