Bug 1830396 (CVE-2020-12689)
| Summary: | CVE-2020-12689 openstack-keystone: EC2 and credential endpoints are not protected from a scoped context | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Laura Pardo <lpardo> | ||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||
| Status: | CLOSED ERRATA | QA Contact: | |||||
| Severity: | high | Docs Contact: | |||||
| Priority: | high | ||||||
| Version: | unspecified | CC: | aileenc, bdettelb, chazlett, dbecker, drieden, ggaughan, gmalinko, janstey, jjoyce, jochrist, jschluet, jwon, kbasil, lbragsta, lhh, lpeer, mburns, msiddiqu, nkinder, ntait, oblaut, sclewis, security-response-team, slinaber, tomckay, wmealing | ||||
| Target Milestone: | --- | Keywords: | Security | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Keystone 15.0.1, Keystone 16.0.1 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: |
A vulnerability was found in Keystone's EC2 credentials API. This flaw allows any user authenticated within a limited scope (trust/OAuth/application credential) to create an EC2 credential with escalated permissions, for example, obtaining an "admin" role, while the user is on a limited "viewer" role.
|
Story Points: | --- | ||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2020-06-24 17:20:28 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 1831354, 1831355, 1831356, 1831357, 1832399 | ||||||
| Bug Blocks: | 1830398 | ||||||
| Attachments: |
|
||||||
|
Description
Laura Pardo
2020-05-01 20:03:01 UTC
Created attachment 1683826 [details] propossed patch Created attachment 1683826 [details] 0001-Respect-token-roles-when-creating-EC2-credentials.patch-master References: https://launchpad.net/bugs/1872735 Created openstack-keystone tracking bugs for this issue: Affects: openstack-rdo [bug 1832399] External References: https://security.openstack.org/ossa/OSSA-2020-004.html Acknowledgments: Name: kay (OpenStack) This issue has been addressed in the following products: Red Hat OpenStack Platform 13.0 (Queens) Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS Via RHSA-2020:2732 https://access.redhat.com/errata/RHSA-2020:2732 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-12689 This issue has been addressed in the following products: Red Hat OpenStack Platform 10.0 (Newton) Via RHSA-2020:3096 https://access.redhat.com/errata/RHSA-2020:3096 This issue has been addressed in the following products: Red Hat OpenStack Platform 15.0 (Stein) Via RHSA-2020:3102 https://access.redhat.com/errata/RHSA-2020:3102 This issue has been addressed in the following products: Red Hat OpenStack Platform 16.0 (Train) Via RHSA-2020:3105 https://access.redhat.com/errata/RHSA-2020:3105 Statement: Red Hat Quay includes keystone-client, which is not vulnerable to this (server-side) vulnerability. |