PT-2019-20179 · Openstack · Openstack Keystone

Publicado 2019-12-09 · Atualizado 2019-12-09

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions 15.0.0 through 16.0.0

Description The issue allows any user with a role on a project to list any credentials using the /v3/credentials API endpoint when enforce scope is set to false. This could lead to data leakage, including sign-on information for Time-based One Time Passwords (TOTP), as users with a role on a project can view any other users' credentials.

Recommendations For OpenStack Keystone versions 15.0.0 through 16.0.0, set enforce scope to true to mitigate the issue. As a temporary workaround, consider restricting access to the /v3/credentials API endpoint until the issue is resolved.

Identificadores relacionados

PYSEC-2019-99

Produtos afetados

Openstack Keystone

Referências · 9

• https://access.redhat.com/errata/RHSA-2019:4358 · Nota
• https://usn.ubuntu.com/4262-1 · Nota
• https://security.openstack.org/ossa/OSSA-2019-006.html · Nota
• https://bugs.launchpad.net/keystone/+bug/1855080 · Nota
• https://review.opendev.org/#/c/697731 · Nota
• http://openwall.com/lists/oss-security/2019/12/11/8 · Nota
• https://review.opendev.org/#/c/697355 · Nota
• https://review.opendev.org/#/c/697611 · Nota
• https://osv.dev/vulnerability/PYSEC-2019-99 · Aviso do Fabricante