OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by (1) creating new tokens through token chaining, (2) leveraging possession of a token for a disabled user account, or (3) leveraging possession of a token for an account with a changed password.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does
    not properly implement token expiration, which allows remote authenticated users to bypass intended
    authorization restrictions by (1) creating new tokens through token chaining, (2) leveraging possession of
    a token for a disabled user account, or (3) leveraging possession of a token for an account with a changed
    password. (CVE-2012-3426)

Vijaya Erukala discovered that Keystone did not properly invalidate EC2-style credentials such that if credentials were removed from a tenant, an authenticated and authorized user using those credentials may still be allowed access beyond the account owner's expectations.
(CVE-2012-5571)

It was discovered that Keystone did not properly implement token expiration. A remote attacker could use this to continue to access an account that is disabled or has a changed password. This issue was previously fixed as CVE-2012-3426 but was reintroduced in Ubuntu 12.10. (CVE-2012-5563).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Dolph Mathews discovered that OpenStack Keystone did not properly restrict to administrative users the ability to update users' tenants.
A remote attacker that can reach the administrative API can use this to add any user to any tenant. (CVE-2012-3542)

Derek Higgins discovered that OpenStack Keystone did not properly implement token expiration. A remote attacker could use this to continue to access an account that has been disabled or has a changed password. (CVE-2012-3426).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
433053	SCA: security update for Keystone (GHSA-xp97-6w7r-4cjc)	Tenable Cloud Security	SCA Checks	high
433053	SCA: security update for Keystone (GHSA-xp97-6w7r-4cjc)	Tenable Self-Hosted Container Security	SCA Checks	high
63093	Ubuntu 12.04 LTS / 12.10 : keystone vulnerabilities (USN-1641-1)	Nessus	Ubuntu Local Security Checks	medium
61772	Ubuntu 12.04 LTS : keystone vulnerabilities (USN-1552-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2012-3426

high

Tenable Plugins

high

high

medium

medium