CVE-2012-5563
OpenStack Keystone Insufficient token expiration
CVE-2012-5563 is a medium vulnerability (CVSS 4.0) in Openstack Folsom, published December 18, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.92%, the 87th percentile. Fixed in keystone 8.0.0.
- Severity
- 4.0 MediumCVSS 2.0, NVD
- Exploit chance
- 2.92%EPSS, 87th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
8.0.0keystone +4 more
Description
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystonePyPI | before 8.0.0 | 8.0.0 |
keystonePyPI | All versions, plus listed versions 12.0.212.0.313.0.213.0.313.0.4 Show 45 moreShow less14.0.014.0.114.1.014.2.015.0.015.0.0.0rc115.0.0.0rc215.0.116.0.016.0.0.0rc116.0.0.0rc216.0.116.0.217.0.017.0.0.0rc117.0.0.0rc217.0.118.0.018.0.0.0rc118.1.019.0.019.0.0.0rc119.0.0.0rc219.0.120.0.020.0.0.0rc120.0.121.0.021.0.0.0rc121.0.122.0.022.0.0.0rc122.0.122.0.223.0.023.0.0.0rc123.0.123.0.224.0.024.0.0.0rc124.1.025.0.025.0.0.0rc126.0.026.0.0.0rc1 | None known |
openstack-keystoneRed Hat:openstack:2::el6 From an advisory covering 2 CVEs | before 0:2012.2.1-1.el6ost | 0:2012.2.1-1.el6ost |
openstack-keystone-docRed Hat:openstack:2::el6 From an advisory covering 2 CVEs | before 0:2012.2.1-1.el6ost | 0:2012.2.1-1.el6ost |
python-keystoneRed Hat:openstack:2::el6 From an advisory covering 2 CVEs | before 0:2012.2.1-1.el6ost | 0:2012.2.1-1.el6ost |
What each source reports
NVD Score used
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
- Record
CVE-2012-5563- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-255
- Updated
- 2026-11-02
CVE ListNo score
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
- Record
CVE-2012-5563- Updated
- 2026-11-02
EUVDEUVD-2012-0014No score
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
- Record
EUVD-2012-0014- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w66p-78g4-mr7g
OpenStack Keystone Insufficient token expiration
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
- Record
GHSA-w66p-78g4-mr7g- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-324, CWE-863
- Updated
- 2026-11-02
OSVGHSA-w66p-78g4-mr7g
OpenStack Keystone Insufficient token expiration
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
- Record
GHSA-w66p-78g4-mr7g- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-324, CWE-863
- Updated
- 2026-11-02
OSVRHSA-2012:1557
Red Hat Security Advisory: openstack-keystone security, bug fix, and enhancement update
- Record
RHSA-2012:1557- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-13
OSVPYSEC-2012-20No score
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
- Record
PYSEC-2012-20- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, references | OSV | |
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
rhn.redhat.com/errata/RHSA-2012-1557.html
openwall.com/lists/oss-security/2012/11/28/5
github.com/openstack/keystone/commit/38c7e46a640a94da4da89a39a5a1ea9c081f1eb5
securityfocus.com/bid/56727
ubuntu.com/usn/USN-1641-1
Show 31 moreShow less
bugs.launchpad.net/keystone/+bug/1079216
secunia.com/advisories/51423
exchange.xforce.ibmcloud.com/vulnerabilities/80370
nvd.nist.gov/vuln/detail/CVE-2012-5563
web.archive.org/web/20200228144943/http://www.securityfocus.com/bid/56727
access.redhat.com/errata/RHSA-2012:1557
bugzilla.redhat.com/show_bug.cgi?id=879402
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1557.json
cve.org/CVERecord?id=CVE-2012-5563
lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html
Left out here: 20 versions. The JSON record has them.