REDHAT-BUG-2482840: High severity Openstack Keystone vulnerability
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforcecall unconditionally merges the raw JSON request body into the policy enforcement dictionary via policydict.update(jsoninput.copy()), overwriting trusted target data that was previously set from database lookups. Because flask.request.getjson is called with force=True, this works regardless of Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g., userid, projectid) into the request body to bypass RBAC checks and perform unauthorized operations on resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenStack Keystoneto a version that resolves this vulnerability.Fixed in 29.0.2
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2482840?
The severity of REDHAT-BUG-2482840 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2482840?
To fix REDHAT-BUG-2482840, upgrade OpenStack Keystone to version 29.0.2 or later.
What is the risk level associated with REDHAT-BUG-2482840?
The risk level associated with REDHAT-BUG-2482840 is rated at 33.
What vulnerability does REDHAT-BUG-2482840 pertain to?
REDHAT-BUG-2482840 pertains to an issue in OpenStack Keystone affecting its RBAC policy enforcer.
What kind of data can be overwritten due to REDHAT-BUG-2482840?
REDHAT-BUG-2482840 can result in trusted target data previously set being overwritten.