PT-2019-20179 · Openstack · Openstack Keystone

Published 2019-12-09 · Updated 2019-12-09

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions 15.0.0 through 16.0.0

Description The issue allows any user with a role on a project to list any credentials using the /v3/credentials API endpoint when enforce scope is set to false. This could lead to data leakage, including sign-on information for Time-based One Time Passwords (TOTP), as users with a role on a project can view any other users' credentials.

Recommendations For OpenStack Keystone versions 15.0.0 through 16.0.0, set enforce scope to true to mitigate the issue. As a temporary workaround, consider restricting access to the /v3/credentials API endpoint until the issue is resolved.

Related Identifiers

PYSEC-2019-99

Affected Products

Openstack Keystone

References · 9

• https://osv.dev/vulnerability/PYSEC-2019-99 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:4358 · Note
• https://usn.ubuntu.com/4262-1 · Note
• https://security.openstack.org/ossa/OSSA-2019-006.html · Note
• https://bugs.launchpad.net/keystone/+bug/1855080 · Note
• https://review.opendev.org/#/c/697731 · Note
• http://openwall.com/lists/oss-security/2019/12/11/8 · Note
• https://review.opendev.org/#/c/697355 · Note
• https://review.opendev.org/#/c/697611 · Note