CVE-2018-14432: Infoleak
A flaw was found in Keystone federation. By doing GET /v3/OS-FEDERATION/projects an authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.
Other sources
In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-14432?
CVE-2018-14432 is a vulnerability in the Federation component of OpenStack Keystone that allows an authenticated user to bypass access restrictions and discover projects they have no authority to access.
What is the severity of CVE-2018-14432?
The severity of CVE-2018-14432 is high with a CVSS score of 5.3.
How does CVE-2018-14432 impact OpenStack Keystone?
CVE-2018-14432 allows an authenticated user to leak project information that they shouldn't have access to in OpenStack Keystone.
Are there any known fixes for CVE-2018-14432?
Yes, there are known fixes for CVE-2018-14432. Please refer to the official references for remediation steps.
Where can I find more information about CVE-2018-14432?
You can find more information about CVE-2018-14432 in the official references provided.