CVE-2012-5571

Publication date 28 November 2012

Last updated 8 April 2026

Ubuntu priority

Cvss 3 Severity Score

Description

A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
keystone	12.10 quantal	Fixed 2012.2-0ubuntu1.2
	12.04 LTS precise	Fixed 2012.1+stable~20120824-a16a0ab9-0ubuntu2.3
	11.10 oneiric	Ignored
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Not in release

Notes

jdstrand

Keystone on 11.10 is a pre-release version and unusable with other components such as nova and horizon

Severity score breakdown

Parameter	Value
Base score	5.4 · Medium
Attack vector	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity impact	Low
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

Related Ubuntu Security Notices (USN)

USN-1641-1
OpenStack Keystone vulnerabilities
28 November 2012