Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : OpenStack Keystone vulnerabilities (USN-8433-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-8433-1. The text
# itself is copyright (C) Canonical, Inc. See
# <https://ubuntu.com/security/notices>. Ubuntu(R) is a registered
# trademark of Canonical, Inc.
##

include('compat.inc');

if (description)
{
  script_id(321365);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/17");

  script_cve_id(
    "CVE-2026-33551",
    "CVE-2026-40683",
    "CVE-2026-42998",
    "CVE-2026-42999",
    "CVE-2026-43000",
    "CVE-2026-43001",
    "CVE-2026-44394"
  );
  script_xref(name:"USN", value:"8433-1");

  script_name(english:"Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : OpenStack Keystone vulnerabilities (USN-8433-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Ubuntu host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple
vulnerabilities as referenced in the USN-8433-1 advisory.

    It was discovered that OpenStack Keystone allowed restricted application credentials to create EC2
    credentials. An authenticated attacker with only a reader role could possibly use this issue to bypass the
    role restrictions imposed on the application credential. (CVE-2026-33551)

    It was discovered that the OpenStack Keystone LDAP identity backend did not correctly convert the user
    enabled attribute to a boolean value. An attacker could possibly use this issue to authenticate as a user
    disabled in LDAP. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10.
    (CVE-2026-40683)

    It was discovered that OpenStack Keystone's application credential authentication plugin did not verify
    that the user supplied in an authentication request matched the credential owner. An authenticated
    attacker could possibly impersonate another user and gain access to their tokens and credentials.
    (CVE-2026-42998)

    It was discovered that OpenStack Keystone's RBAC policy enforcer unconditionally merged the raw JSON
    request body into the policy enforcement dictionary, overwriting trusted target data. An authenticated
    attacker could possibly use this issue to inject arbitrary policy attributes to bypass RBAC checks.
    (CVE-2026-42999)

    It was discovered that OpenStack Keystone allowed an attacker with the member role to escalate privileges
    to admin by chaining application credential impersonation with Keystone trusts. An attacker could possibly
    use this issue to create a persistent trust delegating the victim's admin role to themselves.
    (CVE-2026-43000)

    It was discovered that OpenStack Keystone did not validate that the project_id for an EC2 credential
    matched the project of the authenticating application credential. An attacker with valid credentials for
    one project could possibly use this issue to create EC2 credentials targeting a different project.
    (CVE-2026-43001)

    It was discovered that OpenStack Keystone's federated token rescoping mechanism did not propagate the
    original token's expiry to the newly issued token. A remote attacker could possibly use this issue to
    maintain access indefinitely by repeatedly rescoping tokens before expiry. (CVE-2026-44394)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/notices/USN-8433-1");
  script_set_attribute(attribute:"solution", value:
"Update the affected keystone, keystone-common and / or python3-keystone packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-43000");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:22.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:24.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:25.10");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:26.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:keystone");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:keystone-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python3-keystone");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Ubuntu Local Security Checks");

  script_copyright(english:"Ubuntu Security Notice (C) 2026 Canonical, Inc. / NASL script (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/Ubuntu/release');
if ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');
os_release = chomp(os_release);
if (! ('22.04' >< os_release || '24.04' >< os_release || '25.10' >< os_release || '26.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 22.04 / 24.04 / 25.10 / 26.04', 'Ubuntu ' + os_release);
if ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);

var pkgs = [
    {'osver': '22.04', 'pkgname': 'keystone', 'pkgver': '2:21.0.1-0ubuntu2.4', 'cves': ['CVE-2026-33551', 'CVE-2026-40683', 'CVE-2026-42998', 'CVE-2026-42999', 'CVE-2026-43000', 'CVE-2026-43001', 'CVE-2026-44394']},
    {'osver': '22.04', 'pkgname': 'keystone-common', 'pkgver': '2:21.0.1-0ubuntu2.4', 'cves': ['CVE-2026-33551', 'CVE-2026-40683', 'CVE-2026-42998', 'CVE-2026-42999', 'CVE-2026-43000', 'CVE-2026-43001', 'CVE-2026-44394']},
    {'osver': '22.04', 'pkgname': 'python3-keystone', 'pkgver': '2:21.0.1-0ubuntu2.4', 'cves': ['CVE-2026-33551', 'CVE-2026-40683', 'CVE-2026-42998', 'CVE-2026-42999', 'CVE-2026-43000', 'CVE-2026-43001', 'CVE-2026-44394']},
    {'osver': '24.04', 'pkgname': 'keystone', 'pkgver': '2:25.0.0-0ubuntu1.4', 'cves': ['CVE-2026-33551', 'CVE-2026-40683', 'CVE-2026-42998', 'CVE-2026-42999', 'CVE-2026-43000', 'CVE-2026-43001', 'CVE-2026-44394']},
    {'osver': '24.04', 'pkgname': 'keystone-common', 'pkgver': '2:25.0.0-0ubuntu1.4', 'cves': ['CVE-2026-33551', 'CVE-2026-40683', 'CVE-2026-42998', 'CVE-2026-42999', 'CVE-2026-43000', 'CVE-2026-43001', 'CVE-2026-44394']},
    {'osver': '24.04', 'pkgname': 'python3-keystone', 'pkgver': '2:25.0.0-0ubuntu1.4', 'cves': ['CVE-2026-33551', 'CVE-2026-40683', 'CVE-2026-42998', 'CVE-2026-42999', 'CVE-2026-43000', 'CVE-2026-43001', 'CVE-2026-44394']},
    {'osver': '25.10', 'pkgname': 'keystone', 'pkgver': '2:28.0.0-0ubuntu1.3', 'cves': ['CVE-2026-33551', 'CVE-2026-40683', 'CVE-2026-42998', 'CVE-2026-42999', 'CVE-2026-43000', 'CVE-2026-43001', 'CVE-2026-44394']},
    {'osver': '25.10', 'pkgname': 'keystone-common', 'pkgver': '2:28.0.0-0ubuntu1.3', 'cves': ['CVE-2026-33551', 'CVE-2026-40683', 'CVE-2026-42998', 'CVE-2026-42999', 'CVE-2026-43000', 'CVE-2026-43001', 'CVE-2026-44394']},
    {'osver': '25.10', 'pkgname': 'python3-keystone', 'pkgver': '2:28.0.0-0ubuntu1.3', 'cves': ['CVE-2026-33551', 'CVE-2026-40683', 'CVE-2026-42998', 'CVE-2026-42999', 'CVE-2026-43000', 'CVE-2026-43001', 'CVE-2026-44394']},
    {'osver': '26.04', 'pkgname': 'keystone', 'pkgver': '2:29.0.0-0ubuntu1.2', 'cves': ['CVE-2026-33551', 'CVE-2026-42998', 'CVE-2026-42999', 'CVE-2026-43000', 'CVE-2026-43001', 'CVE-2026-44394']},
    {'osver': '26.04', 'pkgname': 'keystone-common', 'pkgver': '2:29.0.0-0ubuntu1.2', 'cves': ['CVE-2026-33551', 'CVE-2026-42998', 'CVE-2026-42999', 'CVE-2026-43000', 'CVE-2026-43001', 'CVE-2026-44394']},
    {'osver': '26.04', 'pkgname': 'python3-keystone', 'pkgver': '2:29.0.0-0ubuntu1.2', 'cves': ['CVE-2026-33551', 'CVE-2026-42998', 'CVE-2026-42999', 'CVE-2026-43000', 'CVE-2026-43001', 'CVE-2026-44394']}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var osver = NULL;
  var pkgname = NULL;
  var pkgver = NULL;
  if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];
  if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];
  if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (osver && pkgname && pkgver) {
    if (deb_check(release:osver, prefix:pkgname, reference:pkgver, cves:cves)) flag++;
  }
}

if (flag)
{
  var extra = '';
  extra += ubuntu_report_get();
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : extra
  );
  exit(0);
}
else
{
  var tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'keystone / keystone-common / python3-keystone');
}