OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade keystone | Jul 30, 2024 | Apr 12, 2013 |
| Suse | — | Upgrade openstack-swift-testUpgrade openstack-cinder-docUpgrade python-glanceUpgrade openstack-cinder-volumeUpgrade python-horizonUpgrade openstack-quantumUpgrade openstack-nova-networkUpgrade python-keystoneclientUpgrade python-cinderclient-testUpgrade openstack-cinder-schedulerUpgrade openstack-nova-docUpgrade openstack-glanceUpgrade openstack-nova-objectstoreUpgrade openstack-nova-apiUpgrade openstack-glance-docUpgrade python-cinderclient-docUpgrade openstack-keystone-docUpgrade openstack-quickstartUpgrade python-keystoneclient-testUpgrade openstack-cinderUpgrade openstack-quantum-docUpgrade python-novaUpgrade openstack-dashboardUpgrade openstack-nova-testUpgrade openstack-quantum-testUpgrade openstack-dashboard-testUpgrade openstack-cinder-apiUpgrade openstack-nova-certUpgrade openstack-swift-proxyUpgrade openstack-swift-containerUpgrade openstack-nova-computeUpgrade openstack-swift-accountUpgrade python-keystoneclient-docUpgrade openstack-glance-testUpgrade openstack-nova-novncproxyUpgrade python-cinderUpgrade openstack-swift-docUpgrade openstack-nova-vncproxyUpgrade openstack-swift-objectUpgrade openstack-nova-schedulerUpgrade python-cinderclientUpgrade openstack-keystone-testUpgrade openstack-swiftUpgrade python-swiftUpgrade python-django_openstack_authUpgrade openstack-cinder-testUpgrade python-quantumUpgrade openstack-novaUpgrade openstack-nova-volumeUpgrade openstack-keystoneUpgrade python-keystone | Dec 12, 2013 | Apr 12, 2013 |
| Ubuntu | — | Upgrade python-keystone | Nov 8, 2024 | Apr 12, 2013 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub