CVE-2019-19687

A disclosure vulnerability was found in openstack-keystone’s credentials API. Users with a project role are able to list any credentials with the /v3/credentials API when enforce_scope is false. Information for time-based one time passwords (TOTP) may also be disclosed. Deployments running keystone with enforce_scope set to false are also affected. There will be a slight performance impact for the list credentials API once this issue is fixed.

Mitigation

To mitigate this issue, set the [oslo_policy] enforce_scope option to 'true' in the keystone.conf file.