GHSA-qvpr-qm6w-6rcc

Suggest an improvement
Source
https://github.com/advisories/GHSA-qvpr-qm6w-6rcc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qvpr-qm6w-6rcc/GHSA-qvpr-qm6w-6rcc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-qvpr-qm6w-6rcc
Aliases
Published
2022-05-17T01:39:21Z
Modified
2026-06-10T19:15:10.363103049Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
OpenStack Keystone intended authorization restrictions bypass
Details

OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.

Database specific 
{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-639"
    ],
    "severity": "MODERATE",
    "nvd_published_at": "2012-12-18T01:55:00Z",
    "github_reviewed_at": "2024-01-12T20:22:36Z"
}
References

Affected packages

PyPI / keystone

Package

Name
keystone
View open source insights on deps.dev
Purl
pkg:pypi/keystone

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.0.0a0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qvpr-qm6w-6rcc/GHSA-qvpr-qm6w-6rcc.json"