CVE-2020-12692

Katalog CVE

CVSS 5.4 · Medium EPSS 0,71%

Kerentanan Authentication Bypass by Capture-replay pada openstack keystone, canonical ubuntu linux. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.

Rincian

Terbit di NVD

7 Mei 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-294: Authentication Bypass by Capture-replay
CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.openstack.org/ossa/OSSA-2020-003.html advisory vendor
• http://www.openwall.com/lists/oss-security/2020/05/07/1 mailing list · advisory pihak ketiga
• https://bugs.launchpad.net/keystone/+bug/1872737 advisory pihak ketiga
• https://usn.ubuntu.com/4480-1/ advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2020/05/06/4 mailing list · advisory pihak ketiga