Description
OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | keystone | 2012.1.1-5 | — |
| Debian 13 | keystone | 2012.1.1-5 | — |
| Debian 12 | keystone | 2012.1.1-5 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 1 | python-keystone +3 | 2012.1.2-4.el6 | RHSA-2012:1378 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | keystone | < 2012.1 | 2012.1 | GHSA-gf2q-j2qq-pjf2 |
| PyPI | keystone | all versions | — | PYSEC-2012-19 |
Advisories 1
- RHSA-2012:1378 Red Hat Security Advisory: openstack-keystone security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
References
- 50467 third-party-advisory
- 55326 vdb-entry
- [openstack] 20120830 [OSSA 2012-013] Keystone, Lack of authorization for adding users to tenants (CVE-2012-3542) mailing-list
- https://github.com/openstack/keystone/commit/c13d0ba606f7b2bdc609a7f388334e5efec3f3aa
- [oss-security] 20120830 [OSSA 2012-013] Keystone, Lack of authorization for adding users to tenants (CVE-2012-3542) mailing-list
- https://github.com/openstack/keystone/commit/5438d3b5a219d7c8fa67e66e538d325a61617155
- 50494 third-party-advisory
- https://bugs.launchpad.net/keystone/+bug/1040626
- USN-1552-1 vendor-advisory