Vulnerability · Published May 6, 2020 · Assigned by mitre
CVE-2020-12689
High 8.8
In plain English
A high-severity security flaw in the keystone package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | keystone | 2:17.0.0~rc2-1 | DEBIAN-CVE-2020-12689 |
| Debian:13 | keystone | 2:17.0.0~rc2-1 | DEBIAN-CVE-2020-12689 |
| Debian:14 | keystone | 2:17.0.0~rc2-1 | DEBIAN-CVE-2020-12689 |
| PyPI | keystone | 15.0.1 | GHSA-chgw-36xv-47cw |
| PyPI | keystone | 16.0.1 | GHSA-chgw-36xv-47cw |
| PyPI | keystone | 15.0.1 | PYSEC-2020-53 |
Affected products (as reported)
References
- https://security.openstack.org/ossa/OSSA-2020-004.html x_refsource_CONFIRM
- https://bugs.launchpad.net/keystone/+bug/1872735 x_refsource_MISC
- https://www.openwall.com/lists/oss-security/2020/05/06/5 x_refsource_MISC
- [oss-security] 20200507 Re: [OSSA-2020-004] Keystone: Keystone credential endpoints allow owner modification and are not protected from a scoped context (CVE PENDING) mailing-list, x_refsource_MLIST
- [druid-commits] 20200520 [GitHub] [druid] ccaominh opened a new pull request #9903: Suppress CVEs for openstack-keystone mailing-list, x_refsource_MLIST
- USN-4480-1 vendor-advisory, x_refsource_UBUNTU