Description
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 2 | python-keystone +2 | 2012.2.1-1.el6ost | RHSA-2012:1557 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | keystone | < 8.0.0 | 8.0.0 | GHSA-w66p-78g4-mr7g |
| PyPI | keystone | all versions | — | PYSEC-2012-20 |
Advisories 1
- RHSA-2012:1557 Red Hat Security Advisory: openstack-keystone security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 8, 2026
References
- RHSA-2012:1557 vendor-advisory
- [oss-security] 20121128 [OSSA 2012-018] EC2-style credentials invalidation issue (CVE-2012-5571) mailing-list
- https://github.com/openstack/keystone/commit/38c7e46a640a94da4da89a39a5a1ea9c081f1eb5
- 56727 vdb-entry
- USN-1641-1 vendor-advisory
- https://github.com/openstack/keystone/commit/f9d4766249a72d8f88d75dcf1575b28dd3496681
- [oss-security] 20121128 [OSSA 2012-019] Extension of token validity through token chaining (CVE-2012-5563) mailing-list
- https://bugs.launchpad.net/keystone/+bug/1079216
- 51423 third-party-advisory
- folsom-tokens-security-bypass(80370) vdb-entry
- 51436 third-party-advisory