REDHAT-BUG-1439586: High severity keystone vulnerability
An authenticated user may receive all the roles assigned to the user's project regardless of the federation mapping when there are rules in which group-based assignments are not used. For example, by requesting an admin user to get a role in their project, the user may be granted the admin privileges for new scoped tokens. All setups using the Keystone federation with projects auto-provisioning and no group based assignments rules are affected.
Affected versions: 10.0.0, 10.0.1, 11.0.0
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1439586?
The severity of REDHAT-BUG-1439586 is classified as high due to the potential for privilege escalation.
How do I fix REDHAT-BUG-1439586?
To fix REDHAT-BUG-1439586, ensure that group-based role assignments are properly configured and that appropriate access controls are enforced.
Who is affected by REDHAT-BUG-1439586?
Users of OpenStack Keystone versions 10.0.0 to 11.0.0 are affected by REDHAT-BUG-1439586.
What kind of user can exploit REDHAT-BUG-1439586?
An authenticated user can exploit REDHAT-BUG-1439586 by requesting a role assignment that could grant them excessive privileges.
What could be the consequences of REDHAT-BUG-1439586?
The consequences of REDHAT-BUG-1439586 include unauthorized access to sensitive resources and potential manipulation of project roles.