Skip to content
OpenAdvisories
High RHSA-2012:1378 4 CVEs

Red Hat Security Advisory: openstack-keystone security update

Published Sep 15, 2024 · Updated Aug 8, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · OpenStack 1 openstack:1::el6 openstack-keystone 0:2012.1.2-4.el6
Red Hat · OpenStack 1 openstack:1::el6 openstack-keystone-doc 0:2012.1.2-4.el6
Red Hat · OpenStack 1 openstack:1::el6 python-keystone 0:2012.1.2-4.el6
Red Hat · OpenStack 1 openstack:1::el6 python-keystone-auth-token 0:2012.1.2-4.el6

Vulnerabilities 4

  • High 7.5
    CVE-2012-3542

    OpenStack Keystone Allows Remote User Account Creation

    OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this ide…

    keystone keystone Debian PyPI
  • Medium —
    CVE-2012-4413

    OpenStack Keystone does not invalidate existing tokens when granting or revoking roles

    OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.

    keystone keystone Debian PyPI
  • High —
    CVE-2012-4456

    OpenStack Keystone Improper Authentication vulnerability

    The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrar…

    keystone keystone Debian PyPI
  • Medium —
    CVE-2012-4457

    OpenStack Keystone Token authorization for a user in a disabled tenant is allowed

    OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant.

    keystone keystone Debian PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=852510
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=855491
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=861179
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=861180
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1378.json
  • report
    https://access.redhat.com/security/cve/CVE-2012-3542
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-3542
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-3542
  • report
    https://access.redhat.com/security/cve/CVE-2012-4413
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-4413
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-4413
  • report
    https://access.redhat.com/security/cve/CVE-2012-4456
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-4456
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-4456
  • report
    https://access.redhat.com/security/cve/CVE-2012-4457
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-4457
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-4457