USN-4262-1: OpenStack Keystone vulnerability

30 January 2020

OpenStack Keystone could be made to expose sensitive information over the network.

Releases

Packages

Details

Daniel Preussker discovered that OpenStack Keystone incorrectly handled the
list credentials API. A user with a role on the project could use this
issue to view any other user's credentials.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.10

In general, a standard system update will make all the necessary changes.

References