Skip to content
OpenAdvisories
Medium USN-3448-1 1 CVE

keystone vulnerability

Published Oct 11, 2017 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Boris Bobrov discovered that OpenStack Keystone incorrectly handled
federation mapping when there are rules in which group-based assignments
are not used. A remote authenticated user may receive all the roles
assigned to a project regardless of the federation mapping, contrary to
expectations.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS keystone 2:9.3.0-0ubuntu3.1

Vulnerabilities 1

  • Medium 6.8
    CVE-2017-2673

    OpenStack Identity service (keystone) Incorrect Authorization

    An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrat…

    [UNKNOWN] openstack-keystone keystone keystone Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2017-2673