CVE-2018-14432 In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projec...
MediumCVSS 5.3
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/keystone(Debian:12) | < 2:13.0.0-7 | 2:13.0.0-7 |
| debian/keystone(Debian:13) | < 2:13.0.0-7 | 2:13.0.0-7 |
| debian/keystone(Debian:14) | < 2:13.0.0-7 | 2:13.0.0-7 |
| debian linux | = 9.0 | No fix listed |
| redhat openstack | = 10 | No fix listed |
| redhat openstack | = 12 | No fix listed |
| redhat openstack | = 13 | No fix listed |
| OpenStack Keystone | < 11.0.4 | 11.0.4 |
| OpenStack Keystone | = 12.0.0 | No fix listed |
| OpenStack Keystone | = 13.0.0 | No fix listed |
References
- Debian Security Tracker CVE-2018-14432 vendor-advisory
- [oss-security] 20180725 [OSSA-2018-002] GET /v3/OS-FEDERATION/projects leaks project information (CVE-2018-14432) mailing-list patch third-party-advisory
- 104930 third-party-advisory vdb-entry
- RHSA-2018:2523 vendor-advisory
- RHSA-2018:2533 vendor-advisory
- RHSA-2018:2543 vendor-advisory
- DSA-4275 third-party-advisory vendor-advisory
- bugs.debian.org issue-tracking