The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Keystone | Openstack | 2013.2 (including) | 2013.2.1 (excluding) |
| OpenStack 3 for RHEL 6 | RedHat | openstack-keystone-0:2013.1.5-2.el6ost | * |
| OpenStack 4 for RHEL 6 | RedHat | openstack-keystone-0:2013.2.1-1.el6ost | * |
| Keystone | Ubuntu | raring | * |
| Keystone | Ubuntu | saucy | * |
| Keystone | Ubuntu | upstream | * |