Staging Environment: Content and features may be unstable or change without notice.
Advisory details: pypa / keystone/PYSEC-2026-833
Advisory ID pypa/keystone/PYSEC-2026-833
Aliases CVE-2012-4413
GHSA-mrxv-65rv-6hxq
PYSEC-2026-833
Summary OpenStack Keystone does not invalidate existing tokens when granting or revoking roles OpenStack Keystone before 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
There are no known severity scores.
Reference id Reference type URL
http://github.com/openstack/keystone/commit/58ac6691a21675be9e2ffb0f84a05fc3cd4d2e2e
https://bugs.launchpad.net/keystone/+bug/1041396
https://bugzilla.redhat.com/show_bug.cgi?id=855491
https://exchange.xforce.ibmcloud.com/vulnerabilities/78478
https://opendev.org/openstack/keystone
https://pypi.org/project/keystone
https://review.opendev.org/c/openstack/keystone/+/12870
https://web.archive.org/web/20121114023848/http://www.securityfocus.com/bid/55524
http://www.openwall.com/lists/oss-security/2012/09/12/7
http://www.ubuntu.com/usn/USN-1564-1
CVE-2012-4413 https://access.redhat.com/security/cve/CVE-2012-4413
CVE-2012-4413 https://nvd.nist.gov/vuln/detail/CVE-2012-4413
GHSA-mrxv-65rv-6hxq https://github.com/advisories/GHSA-mrxv-65rv-6hxq
RHSA-2012:1378 https://access.redhat.com/errata/RHSA-2012:1378

No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.

There are no known vectors.

There are no SSVC decisions available.