CVE-2017-2673: High severity red hat openstack for ibm power vulnerability
An authenticated user may receive all the roles assigned to the user's project regardless of the federation mapping when there are rules in which group-based assignments are not used. For example, by requesting an admin user to get a role in their project, the user may be granted the admin privileges for new scoped tokens. All setups using the Keystone federation with projects auto-provisioning and no group based assignments rules are affected.
Affected versions: 10.0.0, 10.0.1, 11.0.0
Other sources
An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2673?
CVE-2017-2673 is classified as a high severity vulnerability due to its potential to allow unauthorized access to administrative roles.
How do I fix CVE-2017-2673?
To remediate CVE-2017-2673, upgrade Keystone to version 10.0.2 or 11.0.1, or apply any other relevant patches provided by Red Hat.
Who is affected by CVE-2017-2673?
CVE-2017-2673 affects authenticated federated users of the OpenStack Identity service in Red Hat OpenStack versions 9 and 10.
What types of roles can be unintentionally granted due to CVE-2017-2673?
Due to CVE-2017-2673, authenticated users can unintentionally be granted all related roles, including administrative roles.
What component of OpenStack is impacted by CVE-2017-2673?
CVE-2017-2673 specifically impacts the Keystone component of the OpenStack Identity service.