CVE-2012-4413
OpenStack Keystone does not invalidate existing tokens when granting or revoking roles
CVE-2012-4413 is a medium vulnerability (CVSS 4.0) in Openstack Keystone, published September 18, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.90%, the 79th percentile. Fixed in keystone 2012.1.3.
- Severity
- 4.0 MediumCVSS 2.0, NVD
- Exploit chance
- 1.90%EPSS, 79th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2012.1.3keystone +9 more
Description
OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystonePyPI | before 2012.1.3 | 2012.1.3 |
keystoneDebian:12 | before 2012.1.1-6 | 2012.1.1-6 |
keystoneDebian:13 | before 2012.1.1-6 | 2012.1.1-6 |
keystoneDebian:14 | before 2012.1.1-6 | 2012.1.1-6 |
keystonePyPI | before 2012.1.3, plus listed versions 12.0.212.0.313.0.213.0.313.0.4 Show 45 moreShow less14.0.014.0.114.1.014.2.015.0.015.0.0.0rc115.0.0.0rc215.0.116.0.016.0.0.0rc116.0.0.0rc216.0.116.0.217.0.017.0.0.0rc117.0.0.0rc217.0.118.0.018.0.0.0rc118.1.019.0.019.0.0.0rc119.0.0.0rc219.0.120.0.020.0.0.0rc120.0.121.0.021.0.0.0rc121.0.122.0.022.0.0.0rc122.0.122.0.223.0.023.0.0.0rc123.0.123.0.224.0.024.0.0.0rc124.1.025.0.025.0.0.0rc126.0.026.0.0.0rc1 | 2012.1.3 |
keystonePyPI | before 2012.1.3, plus listed versions 12.0.212.0.313.0.213.0.313.0.4 Show 45 moreShow less14.0.014.0.114.1.014.2.015.0.015.0.0.0rc115.0.0.0rc215.0.116.0.016.0.0.0rc116.0.0.0rc216.0.116.0.217.0.017.0.0.0rc117.0.0.0rc217.0.118.0.018.0.0.0rc118.1.019.0.019.0.0.0rc119.0.0.0rc219.0.120.0.020.0.0.0rc120.0.121.0.021.0.0.0rc121.0.122.0.022.0.0.0rc122.0.122.0.223.0.023.0.0.0rc123.0.123.0.224.0.024.0.0.0rc124.1.025.0.025.0.0.0rc126.0.026.0.0.0rc1 | 2012.1.3 |
openstack-keystoneRed Hat:openstack:1::el6 From an advisory covering 4 CVEs | before 0:2012.1.2-4.el6 | 0:2012.1.2-4.el6 |
openstack-keystone-docRed Hat:openstack:1::el6 From an advisory covering 4 CVEs | before 0:2012.1.2-4.el6 | 0:2012.1.2-4.el6 |
python-keystoneRed Hat:openstack:1::el6 From an advisory covering 4 CVEs | before 0:2012.1.2-4.el6 | 0:2012.1.2-4.el6 |
python-keystone-auth-tokenRed Hat:openstack:1::el6 From an advisory covering 4 CVEs | before 0:2012.1.2-4.el6 | 0:2012.1.2-4.el6 |
What each source reports
NVD Score used
OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
- Record
CVE-2012-4413- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
- Record
CVE-2012-4413- Updated
- 2026-11-02
EUVDEUVD-2022-4623No score
OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
- Record
EUVD-2022-4623- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mrxv-65rv-6hxqNo score
OpenStack Keystone does not invalidate existing tokens when granting or revoking roles
OpenStack Keystone before 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
- Record
GHSA-mrxv-65rv-6hxq- Updated
- 2026-11-02
OSVNo score
OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
- Record
CVE-2012-4413- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-4413No score
OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
- Record
DEBIAN-CVE-2012-4413- Updated
- 2026-11-02
OSVGHSA-mrxv-65rv-6hxqNo score
OpenStack Keystone does not invalidate existing tokens when granting or revoking roles
OpenStack Keystone before 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
- Record
GHSA-mrxv-65rv-6hxq- Updated
- 2026-11-02
OSVPYSEC-2026-833No score
OpenStack Keystone does not invalidate existing tokens when granting or revoking roles
OpenStack Keystone before 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
- Record
PYSEC-2026-833- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
osvdb.org/85484
secunia.com/advisories/50531
openwall.com/lists/oss-security/2012/09/12/7
exchange.xforce.ibmcloud.com/vulnerabilities/78478
ubuntu.com/usn/USN-1564-1
securityfocus.com/bid/55524
Show 28 moreShow less
nvd.nist.gov/vuln/detail/CVE-2012-4413
access.redhat.com/errata/RHSA-2012:1378
bugs.launchpad.net/keystone/+bug/1041396
bugzilla.redhat.com/show_bug.cgi?id=855491
review.opendev.org/c/openstack/keystone/+/12870
web.archive.org/web/20121114023848/http://www.securityfocus.com/bid/55524
github.com/openstack/keystone/commit/58ac6691a21675be9e2ffb0f84a05fc3cd4d2e2e
security-tracker.debian.org/tracker/CVE-2012-4413
opendev.org/openstack/keystone
pypi.org/project/keystone
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1378.json
cve.org/CVERecord?id=CVE-2012-3542
Left out here: 31 versions. The JSON record has them.