p PatchFirst

CVE-2020-12690

CVE-2020-12690

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.

CVSS 8.8 · High · EPSS 1.9% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • keystone Debian:12

    Affected ranges
    • ECOSYSTEM: < 2:17.0.0~rc2-1

    Update to 2:17.0.0~rc2-1

  • keystone Debian:13

    Affected ranges
    • ECOSYSTEM: < 2:17.0.0~rc2-1

    Update to 2:17.0.0~rc2-1

  • keystone Debian:14

    Affected ranges
    • ECOSYSTEM: < 2:17.0.0~rc2-1

    Update to 2:17.0.0~rc2-1

  • keystone PyPI

    Versions
    • 12.0.2
    • 12.0.3
    • 13.0.2
    • 13.0.3
    • 13.0.4
    • 14.0.0
    • 14.0.1
    • 14.1.0
    • 14.2.0
    • 15.0.0
    • 15.0.0.0rc1
    • 15.0.0.0rc2
    Affected ranges
    • ECOSYSTEM: < 15.0.1

    Update to 15.0.1

  • keystone PyPI

    Versions
    • 16.0.0.0rc1
    • 16.0.0.0rc2
    Affected ranges
    • ECOSYSTEM: ≥ 16.0.0.0rc1, < 16.0.0

    Update to 16.0.0

  • keystone PyPI

    Versions
    • 12.0.2
    • 12.0.3
    • 13.0.2
    • 13.0.3
    • 13.0.4
    • 14.0.0
    • 14.0.1
    • 14.1.0
    • 14.2.0
    • 15.0.0.0rc1
    • 15.0.0.0rc2
    • 15.0.0
    Affected ranges
    • ECOSYSTEM: < 15.0.1

    Update to 15.0.1

  • keystone Ubuntu:Pro:16.04:LTS

    Versions
    • 2:8.0.0-0ubuntu1
    • 2:9.0.0~b1-0ubuntu1
    • 2:9.0.0~b2-0ubuntu1
    • 2:9.0.0~b3-0ubuntu1
    • 2:9.0.0~rc1-0ubuntu1
    • 2:9.0.0-0ubuntu1
    • 2:9.0.2-0ubuntu1
    • 2:9.0.2-0ubuntu2
    • 2:9.1.0-0ubuntu1
    • 2:9.2.0-0ubuntu1
    • 2:9.3.0-0ubuntu1
    • 2:9.3.0-0ubuntu2
    • 2:9.3.0-0ubuntu3
    • 2:9.3.0-0ubuntu3.1
    • 2:9.3.0-0ubuntu3.2
    • 2:9.3.0-0ubuntu3.2+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • keystone Ubuntu:18.04:LTS

    Versions
    • 2:12.0.0-0ubuntu1
    • 2:13.0.0~b1-0ubuntu1
    • 2:13.0.0~b2-0ubuntu1
    • 2:13.0.0~b3-0ubuntu1
    • 2:13.0.0~rc1-0ubuntu1
    • 2:13.0.0~rc2-0ubuntu1
    • 2:13.0.0-0ubuntu1
    • 2:13.0.1-0ubuntu1
    • 2:13.0.2-0ubuntu1
    • 2:13.0.2-0ubuntu3
    Affected ranges
    • ECOSYSTEM: < 2:13.0.4-0ubuntu1

    Update to 2:13.0.4-0ubuntu1

Original sources

Check your server →