CVE-2020-12692
OpenStack Keystone does not check signature TTL of the EC2 credential auth method
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.
- Record
CVE-2020-12692- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - CVSS 2.0
- 5.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:N - Weakness
- CWE-294, CWE-347
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.
- Record
CVE-2020-12692- Updated
- 2026-11-02
EUVDEUVD-2020-0098 No score
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.
- Record
EUVD-2020-0098- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rqw2-hhrf-7936
OpenStack Keystone does not check signature TTL of the EC2 credential auth method
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.
- Record
GHSA-rqw2-hhrf-7936- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-311, CWE-347
- Updated
- 2026-11-02
OSV
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.
- Record
CVE-2020-12692- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-12692
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.
- Record
DEBIAN-CVE-2020-12692- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Show 7 moreShow less
OSVGHSA-rqw2-hhrf-7936
OpenStack Keystone does not check signature TTL of the EC2 credential auth method
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.
- Record
GHSA-rqw2-hhrf-7936- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-311, CWE-347
- Updated
- 2026-11-02
OSVRHSA-2020:2732
Red Hat Security Advisory: openstack-keystone security update
- Record
RHSA-2020:2732- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:3102
Red Hat Security Advisory: openstack-keystone security update
- Record
RHSA-2020:3102- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:3105
Red Hat Security Advisory: openstack-keystone security update
- Record
RHSA-2020:3105- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-12692
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.
- Record
UBUNTU-CVE-2020-12692- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVPYSEC-2020-56 No score
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.
- Record
PYSEC-2020-56- Updated
- 2026-11-02
OSVUSN-4480-1 No score
keystone vulnerabilities
It was discovered that OpenStack Keystone incorrectly handled EC2 credentials. An authenticated attacker with a limited scope could possibly create EC2 credentials with escalated permissions. (CVE-2020-12689, CVE-2020-12691)
It was discovered that OpenStack Keystone incorrectly handled the list of roles provided with OAuth1 access tokens. An authenticated user could possibly end up with more role assignments than intended. (CVE-2020-12690)
It was discovered that OpenStack Keystone incorrectly handled EC2 signature TTL checks. A remote attacker could possibly use this issue to reuse Authorization headers. (CVE-2020-12692)
- Record
USN-4480-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystonePyPI |
16.0.0.0rc1 up to 16.0.0 | 16.0.0 |
keystonePyPI |
before 15.0.1 | 15.0.1 |
keystoneDebian:12 |
before 2:17.0.0~rc2-1 | 2:17.0.0~rc2-1 |
keystoneDebian:13 |
before 2:17.0.0~rc2-1 | 2:17.0.0~rc2-1 |
keystoneDebian:14 |
before 2:17.0.0~rc2-1 | 2:17.0.0~rc2-1 |
keystoneDebian:10 From an advisory covering 4 CVEs |
before 2:14.2.0-0+deb10u1, plus listed versions 2:14.0.1-2 |
2:14.2.0-0+deb10u1 |
keystonePyPI |
16.0.0.0rc1 up to 16.0.0, plus listed versions 16.0.0.0rc2 |
16.0.0 |
keystonePyPI |
before 15.0.1, plus listed versions 12.0.212.0.313.0.213.0.313.0.4 Show 7 moreShow less14.0.014.0.114.1.014.2.015.0.015.0.0.0rc115.0.0.0rc2 |
15.0.1 |
openstack-keystoneRed Hat:openstack:13::el7 From an advisory covering 3 CVEs |
before 1:13.0.4-3.el7ost | 1:13.0.4-3.el7ost |
python-keystoneRed Hat:openstack:13::el7 From an advisory covering 3 CVEs |
before 1:13.0.4-3.el7ost | 1:13.0.4-3.el7ost |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openstack-keystoneRed Hat:openstack:15::el8 From an advisory covering 4 CVEs |
before 1:15.0.1-0.20200512110437.95b2bbe.el8ost | 1:15.0.1-0.20200512110437.95b2bbe.el8ost |
python3-keystoneRed Hat:openstack:15::el8 From an advisory covering 4 CVEs |
before 1:15.0.1-0.20200512110437.95b2bbe.el8ost | 1:15.0.1-0.20200512110437.95b2bbe.el8ost |
openstack-keystoneRed Hat:openstack:16::el8 From an advisory covering 4 CVEs |
before 1:16.0.1-0.20200511063421.40cbb7b.el8ost | 1:16.0.1-0.20200511063421.40cbb7b.el8ost |
python3-keystoneRed Hat:openstack:16::el8 From an advisory covering 4 CVEs |
before 1:16.0.1-0.20200511063421.40cbb7b.el8ost | 1:16.0.1-0.20200511063421.40cbb7b.el8ost |
keystoneUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:8.0.0-0ubuntu12:9.0.0~b1-0ubuntu12:9.0.0~b2-0ubuntu12:9.0.0~b3-0ubuntu12:9.0.0~rc1-0ubuntu1 Show 11 moreShow less2:9.0.0-0ubuntu12:9.0.2-0ubuntu12:9.0.2-0ubuntu22:9.1.0-0ubuntu12:9.2.0-0ubuntu12:9.3.0-0ubuntu12:9.3.0-0ubuntu22:9.3.0-0ubuntu32:9.3.0-0ubuntu3.12:9.3.0-0ubuntu3.22:9.3.0-0ubuntu3.2+esm2 |
None known |
keystoneUbuntu:18.04:LTS |
before 2:13.0.4-0ubuntu1, plus listed versions 2:12.0.0-0ubuntu12:13.0.0~b1-0ubuntu12:13.0.0~b2-0ubuntu12:13.0.0~b3-0ubuntu12:13.0.0~rc1-0ubuntu1 Show 5 moreShow less2:13.0.0~rc2-0ubuntu12:13.0.0-0ubuntu12:13.0.1-0ubuntu12:13.0.2-0ubuntu12:13.0.2-0ubuntu3 |
2:13.0.4-0ubuntu1 |
keystoneUbuntu:18.04:LTS From an advisory covering 4 CVEs |
before 2:13.0.4-0ubuntu1, plus listed versions 2:12.0.0-0ubuntu12:13.0.0~b1-0ubuntu12:13.0.0~b2-0ubuntu12:13.0.0~b3-0ubuntu12:13.0.0~rc1-0ubuntu1 Show 5 moreShow less2:13.0.0~rc2-0ubuntu12:13.0.0-0ubuntu12:13.0.1-0ubuntu12:13.0.2-0ubuntu12:13.0.2-0ubuntu3 |
2:13.0.4-0ubuntu1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-12692 is a medium vulnerability (CVSS 5.4) in Openstack Keystone, published May 6, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in keystone 16.0.0.
References
security.openstack.org/ossa/OSSA-2020-003.html
bugs.launchpad.net/keystone/+bug/1872737
openwall.com/lists/oss-security/2020/05/06/4
usn.ubuntu.com/4480-1
nvd.nist.gov/vuln/detail/CVE-2020-12692
Show 35 moreShow less
opendev.org/openstack/keystone/commit/ab89ea749013e7f2c46260f68504f5687763e019
github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2020-56.yaml
security-tracker.debian.org/tracker/CVE-2020-12692
access.redhat.com/errata/RHSA-2020:2732
bugzilla.redhat.com/show_bug.cgi?id=1830384
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2732.json
cve.org/CVERecord?id=CVE-2020-12689
ubuntu.com/security/CVE-2020-12692