CVE-2012-4456: High severity Openstack Keystone vulnerability
Jason Xu (yinyangxu) discovered several vulnerabilities in OpenStack Keystone token verification:
The first occurs in the API /v2.0/OS-KSADM/services and /v2.0/OS-KSADM/services/{serviceid}, the second occurs in /v2.0/tenants/{tenantid}/users/{userid}/roles
In both cases the OpenStack Keystone code fails to check if the tokens are valid. These issues have been addressed by adding checks in the form of testservicecrudrequiresauth() and testuserrolelistrequiresauth().
External references: https://bugs.launchpad.net/keystone/+bug/1006822 https://bugs.launchpad.net/keystone/+bug/1006815
Other sources
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4456?
CVE-2012-4456 has been classified as a medium severity vulnerability affecting OpenStack Keystone.
How do I fix CVE-2012-4456?
To remediate CVE-2012-4456, upgrade OpenStack Keystone to versions above 2012.1.2 or to 2012.2-milestone1.
What components are affected by CVE-2012-4456?
CVE-2012-4456 affects the OpenStack Keystone versions from 2012.1 to 2012.1.2 and the specific milestone version 2012.2-milestone1.
What mechanisms in OpenStack Keystone are vulnerable in CVE-2012-4456?
The vulnerability in CVE-2012-4456 affects the API calls regarding services and user roles in the Keystone service.
Who discovered CVE-2012-4456?
CVE-2012-4456 was discovered by Jason Xu, also known by the handle yinyangxu.