CVE-2012-3426
OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass
02 Description
OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 2.29% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 83.1% of scored records. A rank, not a probability.
- NVD base score
- The NVD has published no score for this record
- NVD CVSS vector
- No NVD score to derive
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-16.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2012-07-31 10:00Z14 YR AGO
- Last updated
- 2024-08-06 20:05Z2 YR AGO
- Reserved
- 2012-06-14
- Assigning CNA
- redhat
- Record state
- PUBLISHED
- Severity
- Not rated by the issuing CNA
- CNA CVSS vector
- Not published by the issuing CNA
- Weaknesses
- Data version
- 5.1
- Document digest
- 237708e84c9605a98d4363cf40271db10e1bbe830b99244d495b7a2c73e6eece
05 Affected products
06 References
- github.comhttp://github.com/openstack/keystone/commit/d9600434da14976463a0bd03abd8e0309f0db454
- github.comhttp://github.com/openstack/keystone/commit/29e74e73a6e51cffc0371b32354558391826a4aa
- bugs.launchpad.nethttps://bugs.launchpad.net/keystone/+bug/998185
- bugs.launchpad.nethttps://bugs.launchpad.net/keystone/+bug/997194
- launchpad.nethttps://launchpad.net/keystone/essex/2012.1.1/+download/keystone-2012.1.1.tar.gz
- secunia.com50494http://secunia.com/advisories/50494
- github.comhttp://github.com/openstack/keystone/commit/ea03d05ed5de0c015042876100d37a6a14bf56de
- bugs.launchpad.nethttps://bugs.launchpad.net/keystone/+bug/996595
- www.openwall.com[oss-security] 20120727 [OSSA 2012-010] Various Keystone token expiration issues (CVE-2012-3426)http://www.openwall.com/lists/oss-security/2012/07/27/4
- github.comhttp://github.com/openstack/keystone/commit/628149b3dc6b58b91fd08e6ca8d91c728ccb8626
- www.ubuntu.comUSN-1552-1http://www.ubuntu.com/usn/USN-1552-1
- github.comhttp://github.com/openstack/keystone/commit/375838cfceb88cacc312ff6564e64eb18ee6a355
- github.comhttp://github.com/openstack/keystone/commit/a67b24878a6156eab17b9098fa649f0279256f5d
- secunia.com50045http://secunia.com/advisories/50045
07 Fixed in
Debian 12
- keystone Fixed in 2012.1.1-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 13
- keystone Fixed in 2012.1.1-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 14
- keystone Fixed in 2012.1.1-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.