Staging Environment: Content and features may be unstable or change without notice.
Advisory details: pypa / keystone/PYSEC-2026-832
Advisory ID pypa/keystone/PYSEC-2026-832
Aliases CVE-2012-4456
GHSA-mf98-r2gf-2x3w
PYSEC-2026-832
Summary OpenStack Keystone Improper Authentication vulnerability The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
There are no known severity scores.
Reference id Reference type URL
https://bugs.launchpad.net/keystone/+bug/1006815
https://bugs.launchpad.net/keystone/+bug/1006822
https://bugzilla.redhat.com/show_bug.cgi?id=861179
https://exchange.xforce.ibmcloud.com/vulnerabilities/78944
https://github.com/openstack/keystone
https://github.com/openstack/keystone/commit/14b136aed9d988f5a8f3e699bd4577c9b874d6c1
https://github.com/openstack/keystone/commit/1d146f5c32e58a73a677d308370f147a3271c2cb
https://github.com/openstack/keystone/commit/24df3adb3f50cbb5ada411bc67aba8a781e6a431
https://github.com/openstack/keystone/commit/868054992faa45d6f42d822bf1588cb88d7c9ccb
https://lists.launchpad.net/openstack/msg17034.html
https://pypi.org/project/keystone
https://web.archive.org/web/20121114024512/http://www.securityfocus.com/bid/55716
http://www.openwall.com/lists/oss-security/2012/09/28/5
CVE-2012-4456 https://access.redhat.com/security/cve/CVE-2012-4456
CVE-2012-4456 https://nvd.nist.gov/vuln/detail/CVE-2012-4456
GHSA-mf98-r2gf-2x3w https://github.com/advisories/GHSA-mf98-r2gf-2x3w
RHSA-2012:1378 https://access.redhat.com/errata/RHSA-2012:1378

No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.

There are no known vectors.

There are no SSVC decisions available.