Every CVE Search/ Get API key

CVE-2017-12440

Openstack Aodh can be used to launder Keystone trusts

7.5 HighFix available

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.15%Down 0.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.

Record
CVE-2017-12440
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Weakness
CWE-306
Updated
2026-11-02
CVE List No score

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.

Record
CVE-2017-12440
Updated
2026-11-02
EUVDEUVD-2022-3123 No score

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.

Record
EUVD-2022-3123
Updated
2026-11-03
GitHub AdvisoriesGHSA-86cv-9gpx-6hwj 7.5

Openstack Aodh can be used to launder Keystone trusts

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.

Record
GHSA-86cv-9gpx-6hwj
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-306
Updated
2026-11-02
OSV 7.5

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.

Record
CVE-2017-12440
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-12440 7.5

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.

Record
DEBIAN-CVE-2017-12440
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-86cv-9gpx-6hwj 7.5

Openstack Aodh can be used to launder Keystone trusts

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.

Record
GHSA-86cv-9gpx-6hwj
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-306
Updated
2026-11-02
OSVPYSEC-2026-619 7.5

Openstack Aodh can be used to launder Keystone trusts

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.

Record
PYSEC-2026-619
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2017:3227 4.9

Red Hat Security Advisory: openstack-aodh security update

Record
RHSA-2017:3227
CVSS 3.0
4.9 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2018:0315 4.9

Red Hat Security Advisory: openstack-aodh security update

Record
RHSA-2018:0315
CVSS 3.0
4.9 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2017-12440 7.5

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.

Record
UBUNTU-CVE-2017-12440
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVSUSE-SU-2017:2627-1 No score

Security update for openstack-aodh

This update for openstack-aodh fixes the following security issues:

  • CVE-2017-12440: Aodh did not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allowed remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee (bsc#1052604).
  • gnocchi: Fix alarms for unprivileged user.
Record
SUSE-SU-2017:2627-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
aodh
PyPI
 before 6.0.1
6.0.1
aodh
Debian:12
 before 5.0.0-2
5.0.0-2
aodh
Debian:13
 before 5.0.0-2
5.0.0-2
aodh
Debian:14
 before 5.0.0-2
5.0.0-2
aodh
Debian:9
 before 3.0.0-4+deb9u1, plus listed versions
3.0.0-4
3.0.0-4+deb9u1
aodh
PyPI
 before 6.0.1, plus listed versions
0.0.1.dev40041.1.01.1.11.1.21.1.3
Show 27 moreShow less
2.0.02.0.0.0b12.0.0.0b22.0.0.0b32.0.0.0rc12.0.12.0.22.0.32.0.42.0.52.0.63.0.03.0.0.0b23.0.0.0b33.0.0.0rc13.0.13.0.23.0.33.0.44.0.04.0.14.0.24.0.35.0.05.1.05.1.16.0.0
6.0.1
openstack-aodh
Red Hat:openstack:10::el7
 before 0:3.0.4-1.el7ost
0:3.0.4-1.el7ost
openstack-aodh-api
Red Hat:openstack:10::el7
 before 0:3.0.4-1.el7ost
0:3.0.4-1.el7ost
openstack-aodh-common
Red Hat:openstack:10::el7
 before 0:3.0.4-1.el7ost
0:3.0.4-1.el7ost
openstack-aodh-compat
Red Hat:openstack:10::el7
 before 0:3.0.4-1.el7ost
0:3.0.4-1.el7ost
Show 19 moreShow less
Affected packages
PackageAffectedFixed
openstack-aodh-evaluator
Red Hat:openstack:10::el7
 before 0:3.0.4-1.el7ost
0:3.0.4-1.el7ost
openstack-aodh-expirer
Red Hat:openstack:10::el7
 before 0:3.0.4-1.el7ost
0:3.0.4-1.el7ost
openstack-aodh-listener
Red Hat:openstack:10::el7
 before 0:3.0.4-1.el7ost
0:3.0.4-1.el7ost
openstack-aodh-notifier
Red Hat:openstack:10::el7
 before 0:3.0.4-1.el7ost
0:3.0.4-1.el7ost
python-aodh
Red Hat:openstack:10::el7
 before 0:3.0.4-1.el7ost
0:3.0.4-1.el7ost
python-aodh-tests
Red Hat:openstack:10::el7
 before 0:3.0.4-1.el7ost
0:3.0.4-1.el7ost
openstack-aodh
Red Hat:openstack:11::el7
 before 0:4.0.2-3.el7ost
0:4.0.2-3.el7ost
openstack-aodh-api
Red Hat:openstack:11::el7
 before 0:4.0.2-3.el7ost
0:4.0.2-3.el7ost
openstack-aodh-common
Red Hat:openstack:11::el7
 before 0:4.0.2-3.el7ost
0:4.0.2-3.el7ost
openstack-aodh-compat
Red Hat:openstack:11::el7
 before 0:4.0.2-3.el7ost
0:4.0.2-3.el7ost
openstack-aodh-evaluator
Red Hat:openstack:11::el7
 before 0:4.0.2-3.el7ost
0:4.0.2-3.el7ost
openstack-aodh-expirer
Red Hat:openstack:11::el7
 before 0:4.0.2-3.el7ost
0:4.0.2-3.el7ost
openstack-aodh-listener
Red Hat:openstack:11::el7
 before 0:4.0.2-3.el7ost
0:4.0.2-3.el7ost
openstack-aodh-notifier
Red Hat:openstack:11::el7
 before 0:4.0.2-3.el7ost
0:4.0.2-3.el7ost
python-aodh
Red Hat:openstack:11::el7
 before 0:4.0.2-3.el7ost
0:4.0.2-3.el7ost
python-aodh-tests
Red Hat:openstack:11::el7
 before 0:4.0.2-3.el7ost
0:4.0.2-3.el7ost
openstack-aodh
SUSE:OpenStack Cloud 7
 before 3.0.4~a0~dev1-2.3.1
3.0.4~a0~dev1-2.3.1
openstack-aodh-doc
SUSE:OpenStack Cloud 7
 before 3.0.4~a0~dev1-2.3.1
3.0.4~a0~dev1-2.3.1
aodh
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.0.0-61.0.0-72.0.0~b1-0ubuntu12.0.0~b1-0ubuntu22.0.0~b2-2ubuntu1
Show 9 moreShow less
2.0.0~b2-2ubuntu22.0.0~b3-0ubuntu12.0.0~rc1-0ubuntu12.0.0-0ubuntu12.0.1-0ubuntu12.0.2-0ubuntu12.0.4-0ubuntu12.0.5-0ubuntu12.0.6-0ubuntu1
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-12440 is a high vulnerability (CVSS 7.5) in Openstack, published August 18, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.15%, the 82nd percentile. Fixed in aodh 6.0.1.

References

Show 19 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open