REDHAT-BUG-1606868
First published: Fri Jul 20 2018(Updated: )
A flaw was found in Keystone federation. By doing GET /v3/OS-FEDERATION/projects an authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenStack keystonemiddleware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1608595
- https://access.redhat.com/errata/RHSA-2018:2523
- https://access.redhat.com/errata/RHSA-2018:2533
- https://access.redhat.com/errata/RHSA-2018:2543
- https://review.opendev.org/c/openstack/keystone/+/585782/
- https://bugzilla.redhat.com/show_bug.cgi?id=1606868
Frequently Asked Questions
What is the severity of REDHAT-BUG-1606868?
The severity of REDHAT-BUG-1606868 is classified as high due to the potential unauthorized discovery of projects.
How can I mitigate the vulnerability REDHAT-BUG-1606868?
To mitigate the vulnerability REDHAT-BUG-1606868, ensure that proper access controls are configured for the /v3/OS-FEDERATION endpoint in the policy.json file.
Which software is affected by REDHAT-BUG-1606868?
The vulnerability REDHAT-BUG-1606868 affects OpenStack Keystone when the /v3/OS-FEDERATION endpoint is enabled.
Is authentication sufficient to prevent issues with REDHAT-BUG-1606868?
No, authentication alone is not sufficient as REDHAT-BUG-1606868 allows authenticated users to access unauthorized project information.
What type of information is exposed due to REDHAT-BUG-1606868?
REDHAT-BUG-1606868 can expose project information and attributes that should remain confidential to unauthorized users.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-14432
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/openstack
- canonical/openstack keystonemiddleware