Description
An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | openstack-keystone | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | keystone | 2:10.0.0-9 | — |
| Debian 13 | keystone | 2:10.0.0-9 | — |
| Debian 12 | keystone | 2:10.0.0-9 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | keystone | 2:9.3.0-0ubuntu3.1 | USN-3448-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 10 | python-keystone +2 | 1:10.0.1-3.el7ost | RHSA-2017:1597 |
| Red Hat OpenStack 9 | python-keystone +2 | 1:9.3.0-2.el7ost | RHSA-2017:1461 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | keystone | >= 9.0.0, <= 9.3.0 | — | GHSA-j36m-hv43-7w7m |
| PyPI | keystone | >= 10.0.0, < 10.0.2 | 10.0.2 | GHSA-j36m-hv43-7w7m |
| PyPI | keystone | >= 11.0.0, < 11.0.1 | 11.0.1 | GHSA-j36m-hv43-7w7m |
| PyPI | keystone | >= 9.0.0, < 10.0.2 · >= 11.0.0, < 11.0.1 | 10.0.2, 11.0.1 | PYSEC-2018-152 |
Advisories 3
- RHSA-2017:1597 Red Hat Security Advisory: openstack-keystone security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2017:1461 Red Hat Security Advisory: openstack-keystone security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- USN-3448-1 keystone vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
References
- [oss-security] 20170425 [OSSA-2017-004] federated user gets wrong role (CVE-2017-2673) mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2673
- https://bugs.launchpad.net/keystone/+bug/1677723
- RHSA-2017:1461 vendor-advisory
- RHSA-2017:1597 vendor-advisory
- 98032 vdb-entry