← voltar
CVE-2020-12692

CVE-2020-12692

EPSS 0.7%
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.
Produtos afetados
n/a · n/a

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →
Referências
https://bugs.launchpad.net/keystone/+bug/1872737https://security.openstack.org/ossa/OSSA-2020-003.htmlhttps://usn.ubuntu.com/4480-1/https://www.openwall.com/lists/oss-security/2020/05/06/4http://www.openwall.com/lists/oss-security/2020/05/07/1