OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization
    tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by
    requesting a token for the tenant. (CVE-2012-4457)

- Require authz to update user's tenant (CVE-2012-3542)

    - Delete user tokens after role grant/revoke       (CVE-2012-4413)

    - Fails to validate tokens in Admin API (CVE-2012-4456)

    - Fails to raise Unauthorized user error for disabled       tenant (CVE-2012-4457)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
433484	SCA: security update for Keystone (GHSA-x8h4-xf47-pqc3)	Tenable Cloud Security	SCA Checks	high
433484	SCA: security update for Keystone (GHSA-x8h4-xf47-pqc3)	Tenable Self-Hosted Container Security	SCA Checks	high
62417	Fedora 17 : openstack-keystone-2012.1.2-4.fc17 (2012-13075)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2012-4457

high

Tenable Plugins

high

high

high