CVE-2020-12689: High severity Openstack Keystone vulnerability
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue in OpenStack Keystone?
The vulnerability ID for this issue in OpenStack Keystone is CVE-2020-12689.
What is the severity level of CVE-2020-12689?
The severity level of CVE-2020-12689 is high, with a score of 8.8.
How does CVE-2020-12689 affect OpenStack Keystone?
CVE-2020-12689 allows any user authenticated within a limited scope to create an EC2 credential with escalated permissions, such as obtaining admin while on a limited viewer role.
Which versions of Keystone are affected by CVE-2020-12689?
CVE-2020-12689 affects OpenStack Keystone versions before 15.0.1 and 16.0.0.
What is the remedy for CVE-2020-12689?
The remedy for CVE-2020-12689 is to update to the recommended versions of Keystone, which are 2:14.2.0-0+deb10u1, 2:18.0.0-3+deb11u1, 2:22.0.0-2, and 2:24.0.0-1 (for Debian), or 2:13.0.4-0ubuntu1 (for Ubuntu).