PT-2020-13207 · Openstack+1 · Openstack Keystone+1

Kay · Published 2020-05-06 · Updated 2021-07-13 · CVE-2020-12690

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 15.0.1 OpenStack Keystone version 16.0.0

Description An issue in OpenStack Keystone causes the list of roles provided for an OAuth1 access token to be silently ignored. When an access token is used to request a keystone token, the resulting keystone token contains every role assignment the creator had for the project, potentially leading to unintended escalated access.

Recommendations For OpenStack Keystone versions prior to 15.0.1, update to version 15.0.1 or later to resolve the issue. For OpenStack Keystone version 16.0.0, consider disabling the use of OAuth1 access tokens until a patch is available.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2020-12690

DSA-4679-1

GHSA-6M8P-X4QW-GH5J

PYSEC-2020-54

RHSA-2020:3102

RHSA-2020:3105

USN-4480-1

Affected Products

Openstack Keystone

Ubuntu

References · 26

• https://ubuntu.com/security/CVE-2020-12690 · Vendor Advisory
• https://usn.ubuntu.com/4480-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-12690 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12691 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6m8p-x4qw-gh5j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12690 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-12690 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-12690 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12689 · Vendor Advisory
• https://security.openstack.org/ossa/OSSA-2020-005.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12690 · Vendor Advisory
• https://bugs.launchpad.net/keystone/+bug/1873290 · Patch
• https://osv.dev/vulnerability/DSA-4679-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12692 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-54 · Vendor Advisory