CVE-2020-12690: High severity Openstack Keystone vulnerability
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-12690?
CVE-2020-12690 is an issue discovered in OpenStack Keystone before version 15.0.1 and 16.0.0 where the list of roles provided for an OAuth1 access token is silently ignored.
How does CVE-2020-12690 impact OpenStack Keystone?
CVE-2020-12690 allows an access token to contain every role assignment the creator had for the project when used to request a keystone token.
What is the severity of CVE-2020-12690?
The severity of CVE-2020-12690 is rated as high, with a severity score of 8.8.
Which versions of OpenStack Keystone are affected by CVE-2020-12690?
OpenStack Keystone versions before 15.0.1 and 16.0.0 are affected by CVE-2020-12690.
How can I fix CVE-2020-12690 in OpenStack Keystone?
To fix CVE-2020-12690, upgrade to OpenStack Keystone version 15.0.1 or 16.0.0.