GitHub Advisoryadvisory · PyPI

GHSA-2j23-fwqm-mgwr OpenStack Keystone Credential Leakage

HIGH Published 2022-05-24 Modified 2024-09-27 Official page ↗
Aliases
CVE-2019-19687
Ecosystem
PyPI
Packages
keystone
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-522
Reviewed
2023-07-18

Affected packages

• PyPI keystone: >= 15.0.0, < 15.0.1 → fixed in 15.0.1 • PyPI keystone: >= 16.0.0, < 16.0.1 → fixed in 16.0.1

Description

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the `/v3/credentials` API when `enforce_scope` is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)

Related

Alias · CVE (1)

  • CVE-2019-19687 OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References