Bug 1606868 (CVE-2018-14432) - CVE-2018-14432 openstack-keystone: Information Exposure through /v3/OS-FEDERATION/projects
Summary: CVE-2018-14432 openstack-keystone: Information Exposure through /v3/OS-FEDERA...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-14432
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1607216 1607217 1607218 1607219 1607220 1607221 1607222 1608595
Blocks: 1606871
TreeView+ depends on / blocked
 
Reported: 2018-07-20 22:01 UTC by Laura Pardo
Modified: 2021-05-07 02:56 UTC (History)
28 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Keystone federation. By doing GET /v3/OS-FEDERATION/projects an authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.
Clone Of:
Environment:
Last Closed: 2019-06-10 10:33:51 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Launchpad 1779205 0 None None None 2018-07-25 22:53:51 UTC
OpenStack gerrit 585782 0 None MERGED Reduce duplication in federated auth APIs 2020-11-16 11:17:43 UTC
Red Hat Product Errata RHSA-2018:2523 0 None None None 2018-08-20 12:57:05 UTC
Red Hat Product Errata RHSA-2018:2533 0 None None None 2018-08-21 16:48:19 UTC
Red Hat Product Errata RHSA-2018:2543 0 None None None 2018-08-22 16:24:12 UTC

Description Laura Pardo 2018-07-20 22:01:00 UTC 
A flaw was found in Keystone federation. By doing GET /v3/OS-FEDERATION/projects an authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.
Comment 5 James Hebden 2018-07-25 22:23:22 UTC 
Created openstack-keystone tracking bugs for this issue:

Affects: openstack-rdo [bug 1608595]
Comment 13 errata-xmlrpc 2018-08-20 12:56:54 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 12.0 (Pike)

Via RHSA-2018:2523 https://access.redhat.com/errata/RHSA-2018:2523
Comment 17 errata-xmlrpc 2018-08-21 16:48:07 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 13.0 (Queens)

Via RHSA-2018:2533 https://access.redhat.com/errata/RHSA-2018:2533
Comment 18 errata-xmlrpc 2018-08-22 16:24:00 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 10.0 (Newton)

Via RHSA-2018:2543 https://access.redhat.com/errata/RHSA-2018:2543
Comment 19 Suraj Chandegave 2018-10-09 07:25:45 UTC 
Hi,

From above link, I see that fix for this vulnerability is available for pike, ocata and queens release of openstack. Is there any plan to fix this for kilo release?

Thanks,
Suraj
Comment 20 James Hebden 2018-10-10 01:13:35 UTC 
Hello Suraj,

Analysis of this flaw found that it was not reproducable on versions of OpenStack older than Ocata (RHOS 10).
I have reviewed and clarified this by ensuring all editions are marked as not affected below RHOS 10.
RHOS 7 had been listed as WONTFIX instead of not affected, given RHOS 7 is EOL. I have updated this to be listed also as not affected to further clarify that this flaw was not reproducable on RHOS 7 (Kilo).
 
In general, if you require any fixes for EOL Red Hat products, you will need to open a support case under your organisation's Red Hat support agreement to explore the possibility of backported fixes under an extended support agreement. Fixes for EOL products (such as RHOS 7) can be investigated and shipped under these circumstances only.

Best Regards,
James
Comment 21 Suraj Chandegave 2018-10-10 09:01:10 UTC 
Thanks James for the update.
Comment 26 Jason Shepherd 2021-05-07 02:56:52 UTC 
Statement:

Red Hat Quay does not include the vulnerable keystone/federation/controllers.py file fixed in [1]

[1] https://review.opendev.org/c/openstack/keystone/+/585782/
Note You need to log in before you can comment on or make changes to this bug.