CVE-2013-0282: Medium severity keystone vulnerability
OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0282?
CVE-2013-0282 is considered to have a moderate severity level due to its potential to allow unauthorized access.
How do I fix CVE-2013-0282?
To resolve CVE-2013-0282, upgrade the OpenStack Keystone to version 8.0.0a0 or later.
Which versions of OpenStack Keystone are affected by CVE-2013-0282?
CVE-2013-0282 affects OpenStack Keystone Grizzly prior to 2013.1, Folsom 2012.1.3 and earlier, and Essex.
What type of attacks does CVE-2013-0282 allow?
CVE-2013-0282 allows context-dependent attackers to bypass access restrictions through EC2-style authentication.
Is there a way to mitigate CVE-2013-0282 if an upgrade is not immediately possible?
While direct mitigation is limited, auditing and monitoring access controls can help reduce risk until an upgrade is performed.