{"id":"CVE-2012-5571","aliases":["DEBIAN-CVE-2012-5571","EUVD-2012-0016","GHSA-qvpr-qm6w-6rcc","PYSEC-2012-35"],"status":"published","title":"Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling","description":"A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.02047,"percentile":0.81344,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-255","CWE-639"],"published":"2012-12-18T01:00:00Z","modified":"2026-10-30T21:47:35Z","fixes":[{"ecosystem":"PyPI","package":"keystone","fixed_in":["8.0.0a0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"keystone","fixed_in":["2012.1.1-11"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"keystone","fixed_in":["2012.1.1-11"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"keystone","fixed_in":["2012.1.1-11"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0a0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2012.1.1-11"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2012.1.1-11"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2012.1.1-11"}]}]},{"source":"osv","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0a0"}]}]}],"products":[{"vendor":"openstack","product":"essex"},{"vendor":"openstack","product":"folsom"},{"vendor":"red hat","product":"openstack essex for rhel 6"},{"vendor":"red hat","product":"openstack folsom for rhel 6"},{"vendor":"red hat","product":"red hat openstack platform 13 (queens)"},{"vendor":"red hat","product":"red hat openstack platform 16.2"},{"vendor":"red hat","product":"red hat openstack platform 17.1"},{"vendor":"red hat","product":"red hat openstack platform 18.0"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1556.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1557.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/51423","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/51436","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2012/11/28/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","fix","web"]},{"url":"http://www.openwall.com/lists/oss-security/2012/11/28/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","fix","web"]},{"url":"http://www.securityfocus.com/bid/56726","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-1641-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2012:1556","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2012:1557","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-5571","tags":["vdb-entry","x_refsource_REDHAT","web"]},{"url":"https://bugs.launchpad.net/keystone/+bug/1064914","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80333","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","web"]},{"url":"https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","web"]},{"url":"https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5571","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2012-35.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qvpr-qm6w-6rcc","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2012-5571","tags":["advisory"]},{"url":"https://github.com/openstack/keystone","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2012-5571","title":"Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling","description":"A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.","status":"published","published":"2012-12-18T01:00:00Z","modified":"2026-10-30T18:03:41.392Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:34:49.600255Z"}],"euvd":[{"id":"EUVD-2012-0016","description":"A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.","status":"published","published":"2012-12-18T01:00:00Z","modified":"2026-10-30T18:03:41Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:03.071815Z"}],"ghsa":[{"id":"GHSA-qvpr-qm6w-6rcc","title":"OpenStack Keystone intended authorization restrictions bypass","description":"OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.","status":"published","published":"2022-05-17T01:39:21Z","modified":"2026-04-07T14:23:42Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:39:50.076383Z"}],"nvd":[{"id":"CVE-2012-5571","description":"A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.","status":"published","published":"2012-12-18T01:55:03.57Z","modified":"2026-10-30T19:17:25.99Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-639","CWE-255"],"updated_at":"2026-11-02T14:02:16.958223Z"}],"osv":[{"id":"DEBIAN-CVE-2012-5571","description":"A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.","status":"published","published":"2012-12-18T01:55:03.57Z","modified":"2026-10-30T21:47:35.755642296Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"GHSA-qvpr-qm6w-6rcc","title":"OpenStack Keystone intended authorization restrictions bypass","description":"OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.","status":"published","published":"2022-05-17T01:39:21Z","modified":"2026-06-10T19:15:10.363103049Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"CVE-2012-5571","description":"OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.","status":"published","published":"2012-12-18T01:55:03Z","modified":"2026-04-10T03:44:20.264402Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"PYSEC-2012-35","description":"OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.","status":"withdrawn","published":"2012-12-18T01:55:00Z","modified":"2026-06-10T17:00:17.841982678Z","updated_at":"2026-11-02T15:52:51.254177Z"}]}}