REDHAT-BUG-1606868: High severity keystone vulnerability
A flaw was found in Keystone federation. By doing GET /v3/OS-FEDERATION/projects an authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1606868?
The severity of REDHAT-BUG-1606868 is classified as high due to the potential unauthorized discovery of projects.
How can I mitigate the vulnerability REDHAT-BUG-1606868?
To mitigate the vulnerability REDHAT-BUG-1606868, ensure that proper access controls are configured for the /v3/OS-FEDERATION endpoint in the policy.json file.
Which software is affected by REDHAT-BUG-1606868?
The vulnerability REDHAT-BUG-1606868 affects OpenStack Keystone when the /v3/OS-FEDERATION endpoint is enabled.
Is authentication sufficient to prevent issues with REDHAT-BUG-1606868?
No, authentication alone is not sufficient as REDHAT-BUG-1606868 allows authenticated users to access unauthorized project information.
What type of information is exposed due to REDHAT-BUG-1606868?
REDHAT-BUG-1606868 can expose project information and attributes that should remain confidential to unauthorized users.