CVE-2019-19687

Published: 09 December 2019

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)

Priority

Medium

CVSS 3 base score: 8.8

Status

Package Release Status
keystone
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(2:13.0.2-0ubuntu1)
Ubuntu 16.04 ESM (Xenial Xerus) Not vulnerable
(2:9.3.0-0ubuntu3.2)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist

Patches:
Upstream: https://opendev.org/openstack/keystone/commit/17947516b0095c51da5cff94771247f2e7c44ee6 (15.x)
Upstream: https://opendev.org/openstack/keystone/commit/bd3f63787151183f4daa43578aa491856fefae5b (16.x)