Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 1439586 - (CVE-2017-2673) CVE-2017-2673 openstack-keystone: Incorrect role assignment with federated Keystone
CVE-2017-2673 openstack-keystone: Incorrect role assignment with federated Ke...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20170425,repo...
: Security
Depends On: 1440644 1441472 1441592
Blocks: 1439588
  Show dependency tree / graph
 
Reported: 2017-04-06 05:40 EDT by Adam Mariš
Modified: 2017-06-28 16:43 EDT (History)
24 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-06-28 16:43:00 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
master pike patch (3.38 KB, patch)
2017-04-07 03:30 EDT, Adam Mariš 		no flags Details | Diff
stable ocata patch (3.38 KB, patch)
2017-04-07 03:31 EDT, Adam Mariš 		no flags Details | Diff
cve-2017-2673-openstack-10-newton.patch (3.48 KB, patch)
2017-04-20 02:48 EDT, Tim Suter 		no flags Details | Diff
cve-2017-2673-openstack-11-ocata.patch (5.12 KB, patch)
2017-04-20 02:55 EDT, Tim Suter 		no flags Details | Diff
cve-2017-2673-openstack-12-pike.patch (5.05 KB, patch)
2017-04-20 02:55 EDT, Tim Suter 		no flags Details | Diff
Show Obsolete (2) Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Launchpad 1677723 None None None 2017-04-20 02:50 EDT
Red Hat Product Errata RHSA-2017:1461 normal SHIPPED_LIVE Moderate: openstack-keystone security, bug fix, and enhancement update 2017-06-14 15:29:03 EDT
Red Hat Product Errata RHSA-2017:1597 normal SHIPPED_LIVE Important: openstack-keystone security, bug fix, and enhancement update 2017-06-28 14:52:58 EDT

  None (edit)
Description Adam Mariš 2017-04-06 05:40:34 EDT 
An authenticated user may receive all the roles assigned to the user's project regardless of the federation mapping when there are rules in which group-based assignments are not used. For example, by requesting an admin user to get a role in their project, the user may be granted the admin privileges for new scoped tokens. All setups using the Keystone federation with projects auto-provisioning and no group based assignments rules are affected.

Affected versions: 10.0.0, 10.0.1, 11.0.0
Comment 1 Adam Mariš 2017-04-06 05:40:44 EDT 
Acknowledgments:

Name: the Openstack project
Upstream: Boris Bobrov (Mail.Ru)
Comment 2 Adam Mariš 2017-04-07 03:30 EDT 
Created attachment 1269600 [details]
master pike patch
Comment 3 Adam Mariš 2017-04-07 03:31 EDT 
Created attachment 1269602 [details]
stable ocata patch
Comment 13 Tim Suter 2017-04-20 01:19:29 EDT 
new patches are under review upstream for newton, ocata and pike - will post them once they are accepted.
Comment 14 Tim Suter 2017-04-20 02:48 EDT 
Created attachment 1272868 [details]
cve-2017-2673-openstack-10-newton.patch

added new patch from upstream for openstack 10
Comment 15 Tim Suter 2017-04-20 02:55 EDT 
Created attachment 1272869 [details]
cve-2017-2673-openstack-11-ocata.patch
Comment 16 Tim Suter 2017-04-20 02:55 EDT 
Created attachment 1272870 [details]
cve-2017-2673-openstack-12-pike.patch
Comment 18 Andrej Nemec 2017-04-26 02:49:07 EDT 
References:

http://seclists.org/oss-sec/2017/q2/125
Comment 20 errata-xmlrpc 2017-06-14 11:42:03 EDT 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 9.0 (Mitaka)

Via RHSA-2017:1461 https://access.redhat.com/errata/RHSA-2017:1461
Comment 21 errata-xmlrpc 2017-06-28 11:19:29 EDT 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 10.0 (Newton)

Via RHSA-2017:1597 https://access.redhat.com/errata/RHSA-2017:1597
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.