CVE-2012-4456

Published: 9 October 2012

The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.

Notes

Keystone on 11.10 is a pre-release version and unusable with other
components such as nova and horizon

Status

References

• http://www.openwall.com/lists/oss-security/2012/09/28/5
• https://www.cve.org/CVERecord?id=CVE-2012-4456
• NVD
• Launchpad
• Debian

Bugs

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=689210
• https://bugs.launchpad.net/keystone/+bug/1006815
• https://bugs.launchpad.net/keystone/+bug/1006822