CVE-2012-3542
Fixed in a distro release EPSS 2%
OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.
Products: openstack essex, openstack horizon
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | keystone | 2012.1 |
| PyPI | keystone | 5438d3b5a219d7c8fa67e66e538d325a61617155 |
| PyPI | keystone | c13d0ba606f7b2bdc609a7f388334e5efec3f3aa |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | openstack-keystone-2025.1 | 0 |
| Chainguard | openstack-keystone-2025.1-fips | 0 |
| Chainguard | openstack-keystone-2025.2 | 0 |
| Chainguard | openstack-keystone-2025.2-fips | 0 |
| Chainguard | openstack-keystone-2025.2-fips | 28.0.1_git20260610-r1 |
| Chainguard | openstack-keystone-2025.2-fips | 28.0.1_git20260603-r0 |
| Chainguard | openstack-keystone-2025.2-fips | 28.0.1_git20260610-r0 |
| Chainguard | openstack-keystone-2026.1 | 0 |
| Chainguard | openstack-keystone-2026.1-fips | 0 |
| Chainguard | openstack-keystone-2026.2 | 0 |
| Chainguard | openstack-keystone-2026.2 | 30.0.1_git20261009-r0 |
| Chainguard | openstack-keystone-2026.2-fips | 0 |
| Debian 12 | keystone | 2012.1.1-5 |
| Debian 13 | keystone | 2012.1.1-5 |
| Debian 14 | keystone | 2012.1.1-5 |
| Red Hat openstack 1 | openstack-keystone | 0:2012.1.2-4.el6 |
| Red Hat openstack 1 | openstack-keystone-doc | 0:2012.1.2-4.el6 |
| Red Hat openstack 1 | python-keystone | 0:2012.1.2-4.el6 |
| Red Hat openstack 1 | python-keystone-auth-token | 0:2012.1.2-4.el6 |