OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows
    remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's
    default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an
    open redirect issue, but the correct identifier for that issue is CVE-2012-3540. (CVE-2012-3542)

- Require authz to update user's tenant (CVE-2012-3542)

    - Delete user tokens after role grant/revoke       (CVE-2012-4413)

    - Fails to validate tokens in Admin API (CVE-2012-4456)

    - Fails to raise Unauthorized user error for disabled       tenant (CVE-2012-4457)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Dolph Mathews discovered that OpenStack Keystone did not properly restrict to administrative users the ability to update users' tenants.
A remote attacker that can reach the administrative API can use this to add any user to any tenant. (CVE-2012-3542)

Derek Higgins discovered that OpenStack Keystone did not properly implement token expiration. A remote attacker could use this to continue to access an account that has been disabled or has a changed password. (CVE-2012-3426).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
415078	SCA: security update for keystone (GHSA-gf2q-j2qq-pjf2)	Tenable Cloud Security	SCA Checks	high
415078	SCA: security update for keystone (GHSA-gf2q-j2qq-pjf2)	Tenable Self-Hosted Container Security	SCA Checks	high
62417	Fedora 17 : openstack-keystone-2012.1.2-4.fc17 (2012-13075)	Nessus	Fedora Local Security Checks	high
61772	Ubuntu 12.04 LTS : keystone vulnerabilities (USN-1552-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2012-3542

high

Tenable Plugins

high

high

high

medium