Red Hat Security Advisory: openstack-keystone security update

Fixed packages 3

Vulnerabilities 2

• High 8.8
  CVE-2020-12689

  OpenStack Keystone EC2 and/or credential endpoints are not protected from a scoped context

  An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on…

  keystone keystone keystone Debian Ubuntu PyPI
  May 6, 2020
• High 8.8
  CVE-2020-12691

  OpenStack Keystone V3 /credentials endpoint policy logic allows to change credentials owner or target project ID

  An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowi…

  keystone keystone keystone Debian Ubuntu PyPI
  May 6, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1830384
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1830396
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3096.json
• report
  https://access.redhat.com/security/cve/CVE-2020-12689
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-12689
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-12689
• article
  https://security.openstack.org/ossa/OSSA-2020-004.html
• report
  https://access.redhat.com/security/cve/CVE-2020-12691
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-12691
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-12691