p PatchFirst

CVE-2019-19687

CVE-2019-19687

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)

CVSS 8.8 · High · EPSS 1.8% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • keystone Debian:12

    Affected ranges
    • ECOSYSTEM: < 2:16.0.0-5

    Update to 2:16.0.0-5

  • keystone Debian:13

    Affected ranges
    • ECOSYSTEM: < 2:16.0.0-5

    Update to 2:16.0.0-5

  • keystone Debian:14

    Affected ranges
    • ECOSYSTEM: < 2:16.0.0-5

    Update to 2:16.0.0-5

  • keystone PyPI

    Versions
    • 15.0.0
    Affected ranges
    • ECOSYSTEM: ≥ 15.0.0, < 15.0.1

    Update to 15.0.1

  • keystone PyPI

    Versions
    • 16.0.0
    Affected ranges
    • ECOSYSTEM: ≥ 16.0.0, < 16.0.1

    Update to 16.0.1

  • keystone PyPI

    Versions
    • 12.0.2
    • 12.0.3
    • 13.0.2
    • 13.0.3
    • 13.0.4
    • 14.0.0
    • 14.0.1
    • 14.1.0
    • 14.2.0
    • 15.0.0
    • 15.0.0.0rc1
    • 15.0.0.0rc2
    • 15.0.1
    • 16.0.0
    • 16.0.0.0rc1
    • 16.0.0.0rc2
    Affected ranges
    • ECOSYSTEM: < 16.0.1

    Update to 16.0.1

Original sources

Check your server →