CVE-2012-5571: Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling
A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.
Other sources
OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.
— GitHub
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5571?
The severity of CVE-2012-5571 is considered high due to the potential for unauthorized access to sensitive resources.
How do I fix CVE-2012-5571?
To fix CVE-2012-5571, upgrade Keystone to a version higher than 8.0.0a0.
What types of OpenStack are affected by CVE-2012-5571?
CVE-2012-5571 affects OpenStack Essex (2012.1) and OpenStack Folsom (2012.2).
How can users exploit CVE-2012-5571?
Users can exploit CVE-2012-5571 by using an EC2 token for a role that has been removed from their tenant, bypassing authorization mechanisms.
Is CVE-2012-5571 only relevant to remote authenticated users?
Yes, CVE-2012-5571 specifically allows remote authenticated users to bypass authorization restrictions.