CVE-2012-4456

Publication date 9 October 2012

Last updated 24 July 2024

Ubuntu priority

The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
keystone	12.10 quantal	Not affected
	12.04 LTS precise	Fixed 2012.1+stable~20120824-a16a0ab9-0ubuntu2
	11.10 oneiric	Ignored
	11.04 natty	Not in release
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Not in release

How can I get the fixes?
What do statuses mean?

Notes

jdstrand

Keystone on 11.10 is a pre-release version and unusable with other components such as nova and horizon

References

MITRE
NVD
Launchpad
Debian

Other references

http://www.openwall.com/lists/oss-security/2012/09/28/5
https://www.cve.org/CVERecord?id=CVE-2012-4456