keystone: CVE-2019-19687

Debian Bug report logs - #946614
keystone: CVE-2019-19687

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: keystone: CVE-2019-19687

Date: Wed, 11 Dec 2019 23:10:23 +0100

Source: keystone
Version: 2:16.0.0-4
Severity: grave
Tags: security upstream
Forwarded: https://bugs.launchpad.net/keystone/+bug/1855080

Hi,

The following vulnerability was published for keystone.

CVE-2019-19687[0]:
| OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in
| the list credentials API. Any user with a role on a project is able to
| list any credentials with the /v3/credentials API when enforce_scope
| is false. Users with a role on a project are able to view any other
| users' credentials, which could (for example) leak sign-on information
| for Time-based One Time Passwords (TOTP). Deployments with
| enforce_scope set to false are affected. (There will be a slight
| performance impact for the list credentials API once this issue is
| fixed.)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-19687
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19687
[1] https://bugs.launchpad.net/keystone/+bug/1855080

Regards,
Salvatore

Send a report that this bug log contains spam.