CVE-2012-5571: OpenStack Keystone intended authorization restrictions bypass
(updated )
OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.
References
- access.redhat.com/security/cve/CVE-2012-5571
- bugs.launchpad.net/keystone/+bug/1064914
- exchange.xforce.ibmcloud.com/vulnerabilities/80333
- github.com/advisories/GHSA-qvpr-qm6w-6rcc
- github.com/openstack/keystone
- github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b
- github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19
- github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653
- github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2012-35.yaml
- nvd.nist.gov/vuln/detail/CVE-2012-5571
Code Behaviors & Features
Detect and mitigate CVE-2012-5571 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →