CVE-2020-12692

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 15.0.1 OpenStack Keystone version 16.0.0

Description An issue was discovered in the EC2 API of OpenStack Keystone, where it lacks a signature TTL check for AWS Signature V4. This allows an attacker to sniff the Authorization header and then use it to reissue an OpenStack token an unlimited number of times.

Recommendations For OpenStack Keystone versions prior to 15.0.1, update to version 15.0.1 or later to resolve the issue. For OpenStack Keystone version 16.0.0, consider disabling the EC2 API until a patch is available. As a temporary workaround, restrict access to the Authorization header to minimize the risk of exploitation.