GHSA-qvpr-qm6w-6rcc

Suggest an improvement
Source
https://github.com/advisories/GHSA-qvpr-qm6w-6rcc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qvpr-qm6w-6rcc/GHSA-qvpr-qm6w-6rcc.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-qvpr-qm6w-6rcc
Aliases
Published
2022-05-17T01:39:21Z
Modified
2024-11-22T04:59:30.401662Z
Summary
OpenStack Keystone intended authorization restrictions bypass
Details

OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.

Database specific
{
    "nvd_published_at": "2012-12-18T01:55:00Z",
    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-12T20:22:36Z"
}
References

Affected packages

PyPI / keystone

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.0.0a0