REDHAT-BUG-2458472: Medium severity Openstack Keystone vulnerability
In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the userenabledinvert configuration option is False (the default). The ldaprestomodel method in the UserApi class only performed string-to-boolean conversion when userenabledinvert was True. When False, the raw string value from LDAP (e.g., "FALSE") was used directly. Since non-empty strings are truthy in Python, users marked as disabled in LDAP were treated as enabled by Keystone, allowing them to authenticate and perform actions. All deployments using the LDAP identity backend without userenabledinvert=True or userenabledemulation are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenStack Keystoneto a version that resolves this vulnerability.Fixed in 28.0.1 - Configuration
For deployments using the LDAP identity backend, set user_enabled_invert=True so Keystone performs string-to-boolean conversion for the user enabled attribute instead of using the raw LDAP string value (e.g., "FALSE") directly.
OpenStack Keystone (LDAP identity backend) user_enabled_invert = True
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2458472?
The severity of REDHAT-BUG-2458472 is medium, rated 4.
How do I fix REDHAT-BUG-2458472?
To fix REDHAT-BUG-2458472, upgrade to OpenStack Keystone version 28.0.1 or later.
What is the impact of REDHAT-BUG-2458472?
REDHAT-BUG-2458472 can lead to incorrect user enabled states not being reflected for LDAP users.
What systems are affected by REDHAT-BUG-2458472?
Systems using OpenStack Keystone before version 28.0.1 are affected by REDHAT-BUG-2458472.
What component of OpenStack is involved in REDHAT-BUG-2458472?
The LDAP identity backend in OpenStack Keystone is involved in REDHAT-BUG-2458472.