VYPR
Get started
← All advisories
Medium severity5.4NVD Advisory· Published Dec 18, 2012· Updated Apr 29, 2026

CVE-2012-5571

CVE-2012-5571

Description

A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
KeystonePyPI
< 8.0.0a08.0.0a0

Affected products

2

Patches

3
9d68b40cb9ea

Ensures User is member of tenant in ec2 validation

https://github.com/openstack/keystoneVishvananda IshayaNov 13, 2012via ghsa
commit
1 file changed · +10 −7
  • keystone/contrib/ec2/core.py+10 −7 modified
    @@ -168,6 +168,16 @@ def authenticate(self, context, credentials=None, ec2Credentials=None):
             context=context,
             user_id=user_ref['id'],
             tenant_id=tenant_ref['id'])
+
+        # TODO(termie): optimize this call at some point and put it into the
+        #               the return for metadata
+        # fill out the roles in the metadata
+        roles = metadata_ref.get('roles', [])
+        if not roles:
+            raise exception.Unauthorized(message='User not valid for tenant.')
+        roles_ref = [self.identity_api.get_role(context, role_id)
+                     for role_id in roles]
+
         catalog_ref = self.catalog_api.get_catalog(
             context=context,
             user_id=user_ref['id'],
@@ -180,13 +190,6 @@ def authenticate(self, context, credentials=None, ec2Credentials=None):
                                     tenant=tenant_ref,
                                     metadata=metadata_ref))
 
-        # TODO(termie): optimize this call at some point and put it into the
-        #               the return for metadata
-        # fill out the roles in the metadata
-        roles_ref = []
-        for role_id in metadata_ref.get('roles', []):
-            roles_ref.append(self.identity_api.get_role(context, role_id))
-
         # TODO(termie): make this a util function or something
         # TODO(termie): i don't think the ec2 middleware currently expects a
         #               full return, but it contains a note saying that it
37308dd4f3e3

Ensures User is member of tenant in ec2 validation

https://github.com/openstack/keystoneVishvananda IshayaNov 13, 2012via ghsa
commit
1 file changed · +10 −7
  • keystone/contrib/ec2/core.py+10 −7 modified
    @@ -168,6 +168,16 @@ def authenticate(self, context, credentials=None, ec2Credentials=None):
             context=context,
             user_id=user_ref['id'],
             tenant_id=tenant_ref['id'])
+
+        # TODO(termie): optimize this call at some point and put it into the
+        #               the return for metadata
+        # fill out the roles in the metadata
+        roles = metadata_ref.get('roles', [])
+        if not roles:
+            raise exception.Unauthorized(message='User not valid for tenant.')
+        roles_ref = [self.identity_api.get_role(context, role_id)
+                     for role_id in roles]
+
         catalog_ref = self.catalog_api.get_catalog(
             context=context,
             user_id=user_ref['id'],
@@ -180,13 +190,6 @@ def authenticate(self, context, credentials=None, ec2Credentials=None):
                                     tenant=tenant_ref,
                                     metadata=metadata_ref))
 
-        # TODO(termie): optimize this call at some point and put it into the
-        #               the return for metadata
-        # fill out the roles in the metadata
-        roles_ref = []
-        for role_id in metadata_ref.get('roles', []):
-            roles_ref.append(self.identity_api.get_role(context, role_id))
-
         # TODO(termie): make this a util function or something
         # TODO(termie): i don't think the ec2 middleware currently expects a
         #               full return, but it contains a note saying that it
8735009dc5b8

Ensures User is member of tenant in ec2 validation

https://github.com/openstack/keystoneVishvananda IshayaNov 13, 2012via ghsa
commit
1 file changed · +13 −10
  • keystone/contrib/ec2/core.py+13 −10 modified
    @@ -161,9 +161,19 @@ def authenticate(self, context, credentials=None,
                 context=context,
                 user_id=creds_ref['user_id'])
         metadata_ref = self.identity_api.get_metadata(
-                context=context,
-                user_id=user_ref['id'],
-                tenant_id=tenant_ref['id'])
+            context=context,
+            user_id=user_ref['id'],
+            tenant_id=tenant_ref['id'])
+
+        # TODO(termie): optimize this call at some point and put it into the
+        #               the return for metadata
+        # fill out the roles in the metadata
+        roles = metadata_ref.get('roles', [])
+        if not roles:
+            raise exception.Unauthorized(message='User not valid for tenant.')
+        roles_ref = [self.identity_api.get_role(context, role_id)
+                     for role_id in roles]
+
         catalog_ref = self.catalog_api.get_catalog(
                 context=context,
                 user_id=user_ref['id'],
@@ -176,13 +186,6 @@ def authenticate(self, context, credentials=None,
                                         tenant=tenant_ref,
                                         metadata=metadata_ref))
 
-        # TODO(termie): optimize this call at some point and put it into the
-        #               the return for metadata
-        # fill out the roles in the metadata
-        roles_ref = []
-        for role_id in metadata_ref.get('roles', []):
-            roles_ref.append(self.identity_api.get_role(context, role_id))
-
         # TODO(termie): make this a util function or something
         # TODO(termie): i don't think the ec2 middleware currently expects a
         #               full return, but it contains a note saying that it

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

18

News mentions

0

No linked articles in our index yet.