Vulnerable Systems:
* OpenStack Keystone Red Hat Fedora 17
Successful exploits may allow authenticated attackers to bypass certain intended security restrictions and perform unauthorized actions which may aid in launching further attacks.This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected Fedora versions. It was found that the Keystone administrative API was missing authentication for certain actions. Users able to access the Keystone administrative API could use this flaw to add, start, and stop services, as well as list the roles for any user. (CVE-2012-4456)
It was found that Keystone incorrectly handled disabled tenants. A user belonging to a disabled tenant could use this flaw to continue accessing resources as if the tenant were not disabled. (CVE-2012-4457)
