CVE-2020-12692

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-12692
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-12692.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-12692
Aliases
Downstream
Published
2020-05-07T00:15:10.987Z
Modified
2026-03-14T14:43:56.977622Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.

References

Affected packages

Git / github.com/openstack/keystone

Affected ranges

Type
GIT
Repo
https://github.com/openstack/keystone
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
95b2bbeab113d9f04d1c81f7f1b48bf692bce979
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
dc9e9e32dfbf9fd9c58f9f8e2b35f0bcfd62328e
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "15.0.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "16.0.0"
        }
    ]
}

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "18.04"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-12692.json"