REDHAT-BUG-1139937: High severity keystone vulnerability
The OpenStack project reports:
"" Title: Configuration option leak through Keystone catalog Reporter: Brant Knudson (IBM) Products: Keystone Versions: up to 2013.2.3 and 2014.1 versions up to 2014.1.2.1
Description: Brant Knudson from IBM reported a vulnerability in Keystone catalog URL replacement. By creating a malicious endpoint a privileged user may reveal configuration options resulting in sensitive information, like master admintoken, being exposed through the service url. All Keystone setups that allow non-admin users to create endpoints are affected. ""
Acknowledgements:
Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Brant Knudson from IBM as the original reporter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1139937?
The severity of REDHAT-BUG-1139937 is classified as medium due to the potential exposure of sensitive configuration options.
How do I fix REDHAT-BUG-1139937?
To fix REDHAT-BUG-1139937, upgrade Keystone to a version newer than 2014.1.2.1 or apply recommended patches that address this vulnerability.
What versions are affected by REDHAT-BUG-1139937?
Versions of OpenStack Keystone up to and including 2013.2.3 and 2014.1 up to 2014.1.2.1 are affected by REDHAT-BUG-1139937.
What vulnerabilities does REDHAT-BUG-1139937 expose?
REDHAT-BUG-1139937 exposes configuration options through the Keystone catalog that could be exploited if accessed by unauthorized users.
Who reported REDHAT-BUG-1139937?
The vulnerability REDHAT-BUG-1139937 was reported by Brant Knudson from IBM.