SUSE-SU-2020:0640-1 Security update for ardana-cinder, ardana-cobbler, ardana-designate, ardana-extensions-example, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-input-model, ardana-ironic, ardana-keystone, ardana-logging, ardana-monasca, ardana-monasca-transform, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, keepalived, mariadb, openstack-cinder, openstack-dashboard, openstack-dashboard-theme-SUSE, openstack-heat, openstack-heat-templates, openstack-horizon-plugin-designate-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-ironic, openstack-keystone, openstack-monasca-agent, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vsphere, openstack-nova, openstack-octavia, openstack-octavia-amphora-image, openstack-resource-agents, openstack-sahara, openstack-trove, python-cinderlm, python-congressclient, python-designateclient, python-ironic-lib, python-networking-cisco, python-osc-lib, python-oslo.context, python-oslo.rootwrap, python-oslo.serialization, python-oslo.service, python-stevedore, python-taskflow, rubygem-crowbar-client, rubygem-pumavenv-openstack-swift

This update for ardana-cinder, ardana-cobbler, ardana-designate, ardana-extensions-example, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-input-model, ardana-ironic, ardana-keystone, ardana-logging, ardana-monasca, ardana-monasca-transform, ardana-mq, ardana-neutron, ardana-nova,...

openstack-keystone: Credentials API allows non-admin to list and retrieve all users credentials

A disclosure vulnerability was found in openstack-keystone's credentials API. Users with a project role are able to list any credentials with the /v3/credentials API when enforcescope is false. Information for time-based one time passwords TOTP may also be disclosed. Deployments running keystone...

Ubuntu: Security Advisory (USN-4262-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 19.10 : OpenStack Keystone vulnerability (USN-4262-1)

Daniel Preussker discovered that OpenStack Keystone incorrectly handled the list credentials API. A user with a role on the project could use this issue to view any other user's credentials. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu...

USN-4262-1: OpenStack Keystone vulnerability

Daniel Preussker discovered that OpenStack Keystone incorrectly handled the list credentials API. A user with a role on the project could use this issue to view any other user's credentials...

CVE-2019-3683

The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access, modify, create and delete...

CVE-2019-3683

The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access, modify, create and delete...

Code injection

The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access, modify, create and delete...

CVE-2019-3683

The CVE-2019-3683 issue affects the keystone-json-assignment package in SUSE Openstack Cloud 8 prior to commit d7888c75505465490250c00cc0ef4bb1af662f9f. The root cause is that every user listed in /etc/keystone/user-project-map.json was granted full member access to every project, enabling these ...

PT-2020-10908

Name of the Vulnerable Software and Affected Versions SUSE Openstack Cloud 8 versions before commit d7888c75505465490250c00cc0ef4bb1af662f9f Description The issue allows every user listed in the /etc/keystone/user-project-map.json file to be assigned full member role access to every project,...

CVE-2019-3683: Incorrect Permission Assignment for Critical Resource

The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access, modify, create and delete...

keystone:fuzz_asm_x86_16: Use-of-uninitialized-value in llvm_ks::isIntN

Detailed Report: https://oss-fuzz.com/testcase?key=5739616535838720 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmx8616 Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: llvmks::isIntN X86AsmBackend::applyFixup...

keystone:fuzz_asm_x86_32: Bad-cast to llvm_ks::X86OperandX86AsmParser::MatchAndEmitATTInstruction in AsmParser::parseStatement

Detailed Report: https://oss-fuzz.com/testcase?key=5742122011721728 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmx8632 Job Type: libfuzzerubsankeystone Platform Id: linux Crash Type: Bad-cast Crash Address: 0x00000260e160 Crash State: Bad-cast to...

keystone (>=12.0.2, <=13.0.4) potentially affected by CVE-2020-5390 via pysaml2 (4.0.2)

pysaml2 PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pysaml2 and may be impacted: - keystone =12.0.2, =13.0.4 Source cves: CVE-2020-5390 Source advisory: OSV:PYSEC-2020-94...

keystone:fuzz_asm_mipsbe: Use-of-uninitialized-value in MipsAsmParser::isPicAndNotNxxAbi

Detailed Report: https://oss-fuzz.com/testcase?key=5086719271763968 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmmipsbe Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: MipsAsmParser::isPicAndNotNxxAbi...

keystone:fuzz_asm_sparcbe: Use-of-uninitialized-value in llvm_ks::MCAssembler::computeFragmentSize

Detailed Report: https://oss-fuzz.com/testcase?key=5656891841839104 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmsparcbe Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: llvmks::MCAssembler::computeFragmentSiz...

keystone:fuzz_asm_sparc64be: Heap-buffer-overflow in ELFSparcAsmBackend::applyFixup

Detailed Report: https://oss-fuzz.com/testcase?key=5081419969986560 Project: keystone Fuzzing Engine: afl Fuzz Target: fuzzasmsparc64be Job Type: aflasankeystone Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6070000000d1 Crash State: ELFSparcAsmBackend::applyFixup...

keystone:fuzz_asm_x86_16: Use-of-uninitialized-value in X86AsmParser::ParseIntelOperand

Detailed Report: https://oss-fuzz.com/testcase?key=5746148690362368 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmx8616 Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: X86AsmParser::ParseIntelOperand...

openstack-keystone: Credentials API allows non-admin to list and retrieve all users credentials

A disclosure vulnerability was found in openstack-keystone's credentials API. Users with a project role are able to list any credentials with the /v3/credentials API when enforcescope is false. Information for time-based one time passwords TOTP may also be disclosed. Deployments running keystone...

CVE-2019-19687

A disclosure vulnerability was found in openstack-keystone's credentials API. Users with a project role are able to list any credentials with the /v3/credentials API when enforcescope is false. Information for time-based one time passwords TOTP may also be disclosed. Deployments running keystone...