Skip to content
OpenAdvisories
High USN-4480-1 4 CVEs

keystone vulnerabilities

Published Sep 1, 2020 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that OpenStack Keystone incorrectly handled EC2
credentials. An authenticated attacker with a limited scope could possibly
create EC2 credentials with escalated permissions. (CVE-2020-12689,
CVE-2020-12691)

It was discovered that OpenStack Keystone incorrectly handled the list of
roles provided with OAuth1 access tokens. An authenticated user could
possibly end up with more role assignments than intended. (CVE-2020-12690)

It was discovered that OpenStack Keystone incorrectly handled EC2 signature
TTL checks. A remote attacker could possibly use this issue to reuse
Authorization headers. (CVE-2020-12692)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS keystone 2:13.0.4-0ubuntu1

Vulnerabilities 4

  • High 8.8
    CVE-2020-12689

    OpenStack Keystone EC2 and/or credential endpoints are not protected from a scoped context

    An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on…

    keystone keystone keystone Debian Ubuntu PyPI
  • High 8.8
    CVE-2020-12690

    Insufficient Session Expiration in OpenStack Keystone

    An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignme…

    keystone keystone keystone Debian Ubuntu PyPI
  • High 8.8
    CVE-2020-12691

    OpenStack Keystone V3 /credentials endpoint policy logic allows to change credentials owner or target project ID

    An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowi…

    keystone keystone keystone Debian Ubuntu PyPI
  • Medium 5.4
    CVE-2020-12692

    OpenStack Keystone does not check signature TTL of the EC2 credential auth method

    An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of …

    keystone keystone keystone Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2020-12689
  • report
    https://ubuntu.com/security/CVE-2020-12690
  • report
    https://ubuntu.com/security/CVE-2020-12691
  • report
    https://ubuntu.com/security/CVE-2020-12692