CVE-2019-19687

Priority
Description
OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the
list credentials API. Any user with a role on a project is able to list any
credentials with the /v3/credentials API when enforce_scope is false. Users
with a role on a project are able to view any other users' credentials,
which could (for example) leak sign-on information for Time-based One Time
Passwords (TOTP). Deployments with enforce_scope set to false are affected.
(There will be a slight performance impact for the list credentials API
once this issue is fixed.)
Assigned-to
mdeslaur
Notes
mdeslaurintroduced in keystone 15.0.0, present in 16.0.0 too
Package
Upstream:needs-triage
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):not-affected (2:9.3.0-0ubuntu3.2)
Ubuntu 18.04 LTS (Bionic Beaver):not-affected (2:13.0.2-0ubuntu1)
Ubuntu 19.10 (Eoan Ermine):released (2:16.0.0-0ubuntu1.1)
Ubuntu 20.04 (Focal Fossa):released (2:17.0.0~b1~git2019121613.db81fee63-0ubuntu1)
Patches:
Upstream:https://opendev.org/openstack/keystone/commit/17947516b0095c51da5cff94771247f2e7c44ee6 (15.x)
Upstream:https://opendev.org/openstack/keystone/commit/bd3f63787151183f4daa43578aa491856fefae5b (16.x)
More Information

Updated: 2020-01-30 15:14:56 UTC (commit f11391b079afe6ac4830f202b617642bab06702b)