Bug 1606868 (CVE-2018-14432)
| Summary: | CVE-2018-14432 openstack-keystone: Information Exposure through /v3/OS-FEDERATION/projects | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Laura Pardo <lpardo> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | acanan, apevec, ayoung, bdettelb, chrisw, dbecker, hrybacki, jamsmith, jdennis, jjoyce, jpadman, jschluet, kbasil, lhh, lhinds, lpardo, lpeer, markmc, mburns, nkinder, rbryant, sclewis, security-response-team, slinaber, srevivo, suraj.chandegave, tdecacqu, tomckay |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was found in Keystone federation. By doing GET /v3/OS-FEDERATION/projects an authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-10 10:33:51 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1607216, 1607217, 1607218, 1607219, 1607220, 1607221, 1607222, 1608595 | ||
| Bug Blocks: | 1606871 | ||
|
Description
Laura Pardo
2018-07-20 22:01:00 UTC
Created openstack-keystone tracking bugs for this issue: Affects: openstack-rdo [bug 1608595] This issue has been addressed in the following products: Red Hat OpenStack Platform 12.0 (Pike) Via RHSA-2018:2523 https://access.redhat.com/errata/RHSA-2018:2523 This issue has been addressed in the following products: Red Hat OpenStack Platform 13.0 (Queens) Via RHSA-2018:2533 https://access.redhat.com/errata/RHSA-2018:2533 This issue has been addressed in the following products: Red Hat OpenStack Platform 10.0 (Newton) Via RHSA-2018:2543 https://access.redhat.com/errata/RHSA-2018:2543 Hi, From above link, I see that fix for this vulnerability is available for pike, ocata and queens release of openstack. Is there any plan to fix this for kilo release? Thanks, Suraj Hello Suraj, Analysis of this flaw found that it was not reproducable on versions of OpenStack older than Ocata (RHOS 10). I have reviewed and clarified this by ensuring all editions are marked as not affected below RHOS 10. RHOS 7 had been listed as WONTFIX instead of not affected, given RHOS 7 is EOL. I have updated this to be listed also as not affected to further clarify that this flaw was not reproducable on RHOS 7 (Kilo). In general, if you require any fixes for EOL Red Hat products, you will need to open a support case under your organisation's Red Hat support agreement to explore the possibility of backported fixes under an extended support agreement. Fixes for EOL products (such as RHOS 7) can be investigated and shipped under these circumstances only. Best Regards, James Thanks James for the update. Statement: Red Hat Quay does not include the vulnerable keystone/federation/controllers.py file fixed in [1] [1] https://review.opendev.org/c/openstack/keystone/+/585782/ |