PT-2020-13206 · Openstack+1 · Openstack Keystone+1

Kay · Published 2020-05-06 · Updated 2023-03-01 · CVE-2020-12689

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 15.0.1 OpenStack Keystone version 16.0.0

Description An issue allows any user authenticated within a limited scope to create an EC2 credential with escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.

Recommendations For OpenStack Keystone versions prior to 15.0.1, update to version 15.0.1 or later to resolve the issue. For OpenStack Keystone version 16.0.0, update to a version later than 16.0.0 to resolve the issue.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2020-12689

DSA-4679-1

GHSA-CHGW-36XV-47CW

PYSEC-2020-53

RHSA-2020:2732

RHSA-2020:3096

RHSA-2020:3102

RHSA-2020:3105

USN-4480-1

Affected Products

Openstack Keystone

Ubuntu

References · 25

• https://ubuntu.com/security/CVE-2020-12690 · Vendor Advisory
• https://bugs.launchpad.net/keystone/+bug/1872735 · Patch
• https://usn.ubuntu.com/4480-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12691 · Vendor Advisory
• https://security.openstack.org/ossa/OSSA-2020-004.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12689 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12689 · Security Note
• https://osv.dev/vulnerability/GHSA-chgw-36xv-47cw · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-53 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12689 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4679-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12692 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-12689 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-12689 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-12689 · Vendor Advisory