CVE-2012-5563 json
OpenStack Keystone Insufficient token expiration
published 2012-12-18 13 y ago modified 2026-06-16 4 mo ago also GHSA-w66p-78g4-mr7g , PYSEC-2012-20 , EUVD-2012-0014
- cvss
- 5.9
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.9%
- EPSS 2.9% chance of exploitation in 30 days, percentile 87%
- public exploits
- 0
- none known
Summary
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
Patch / fix
- pypi keystone 8.0.0
- openstack-keystone openstack 2 2012.2.1-1.el6ost
- python-keystone openstack 2 2012.2.1-1.el6ost
red hat advisories RHSA-2012:1557
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2012-5563 updated cvss 4.0
OpenStack: Keystone extension of token validity through token chaining
-
Red Hat OpenStack Folsom python-keystone 2012.2.1-1.el6ost, openstack-keystone 2012.2.1-1.el6ostfixed: vendor fix RHSA-2012:1557
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
2.92% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N |
| GitHub | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | keystone | <8.0.0 all versions |
8.0.0 |
Classification
References
-
github.com
/openstack/keystone/commit/38c7e46a640a94da4da89a39a5a1ea9c081f1eb5
web, patch
-
github.com
/openstack/keystone/commit/f9d4766249a72d8f88d75dcf1575b28dd3496681
web, patch
-
openwall.com
/lists/oss-security/2012/11/28/5
mailing-list, web, patch
-
openwall.com
/lists/oss-security/2012/11/28/6
mailing-list, web, patch
-
rhn.redhat.com
/errata/RHSA-2012-1557.html
vendor-advisory, web, advisory
-
ubuntu.com
/usn/USN-1641-1
vendor-advisory, web, advisory
-
secunia.com
/advisories/51423
third-party-advisory, vendor-advisory, advisory
-
secunia.com
/advisories/51436
third-party-advisory, vendor-advisory, advisory
-
securityfocus.com
/bid/56727
vdb-entry, web
-
bugs.launchpad.net
/keystone/+bug/1079216
web
-
exchange.xforce.ibmcloud.com
/vulnerabilities/80370
vdb-entry, web
-
nvd.nist.gov
/vuln/detail/CVE-2012-5563
advisory
-
github.com
/openstack/keystone
package
-
github.com
/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2012-20.yaml
web
-
web.archive.org
/web/20121201003009/http://secunia.com/advisories/51423
web
-
web.archive.org
/web/20140802122732/http://secunia.com/advisories/51436
web
-
web.archive.org
/web/20200228144943/http://www.securityfocus.com/bid/56727
web
-
github.com
/advisories/GHSA-w66p-78g4-mr7g
advisory
Sources
- CVE List CVE-2012-5563
- GitHub Advisory GHSA-w66p-78g4-mr7g
- NVD CVE-2012-5563
- OSV PYSEC-2012-20
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.