CVE-2012-3426: Medium severity Openstack Essex vulnerability
OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by (1) creating new tokens through token chaining, (2) leveraging possession of a token for a disabled user account, or (3) leveraging possession of a token for an account with a changed password.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3426?
CVE-2012-3426 is classified as a moderate severity vulnerability due to improper token expiration handling.
How do I fix CVE-2012-3426?
To fix CVE-2012-3426, upgrade to OpenStack Keystone version 2012.1.1 or higher.
What systems are affected by CVE-2012-3426?
CVE-2012-3426 affects OpenStack Keystone versions prior to 2012.1.1 and OpenStack Folsom before Folsom-1.
What type of attack does CVE-2012-3426 allow?
CVE-2012-3426 allows remote authenticated users to bypass authorization restrictions by creating new tokens through token chaining.
Is CVE-2012-3426 specific to certain OpenStack versions?
Yes, CVE-2012-3426 specifically impacts OpenStack Keystone before version 2012.1.1 and OpenStack Essex.