Authentication Bypass

openstack-keystone is vulnerable to authentication bypass. The vulnerability exists as the V3 API updates the issuedat value for UUID v2 tokens, and allows authenticated users to bypass the token expiration to retain access...

Authentication Bypass

openstack-keystone is vulnerable to authentication bypass. The vulnerability exists as it does not properly revoke tokens when a domain is invalidated...

Privilege Escalation

openstack-keystone is vulnerable to privilege escalation. A flaw was found in the way keystone handled trusts. A trustee could use an out-of-scope project ID to gain unauthorized access to a project if the trustor had the required roles for that requested project...

Authorization Bypass

The openstack-keystone packages provide Keystone, a Python implementation of the OpenStack identity service API, which provides Identity, Token, Catalog, and Policy services. It was found that Keystone did not correctly handle revoked PKI tokens, allowing users with revoked tokens to retain acces...

Authorization Bypass

Keystone is a Python implementation of the OpenStack http://www.openstack.org identity service API. It was found that Keystone incorrectly handled authorization failures. If a client attempted to change their tenant membership to one they are not authorized to join, Keystone correctly returned a...

Privilege Escalation

Keystone is a Python implementation of the OpenStack http://www.openstack.org identity service API. It was found that Keystone incorrectly handled authorization failures. If a client attempted to change their tenant membership to one they are not authorized to join, Keystone correctly returned a...

Arbitrary Code Execution

Keystone is a Python implementation of the OpenStack http://www.openstack.org identity service API. It was found that Keystone incorrectly handled authorization failures. If a client attempted to change their tenant membership to one they are not authorized to join, Keystone correctly returned a...

Privilege Escalation

The openstack-keystone packages provide Keystone, a Python implementation of the OpenStack identity service API, which provides Identity, Token, Catalog, and Policy services. The openstack-keystone packages have been upgraded to upstream version 2012.1.3, which provides a number of bug fixes and...

python-novajoin: novajoin API lacks access control

A flaw was discovered in the python-novajoin plugin for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens...

keystone/fuzz_asm_sparc64be: Crash in cfree

Detailed report: https://oss-fuzz.com/testcase?key=5741753304350720 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmsparc64be Fuzz target binary: fuzzasmsparc64be Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x718dfffef620 Crash State: cfree...

keystone/fuzz_asm_x86_16: Use-of-uninitialized-value in llvm_ks::MCAssembler::fragmentNeedsRelaxation

Detailed report: https://oss-fuzz.com/testcase?key=6301049676103680 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmx8616 Fuzz target binary: fuzzasmx8616 Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

keystone/fuzz_asm_hex: Use-of-uninitialized-value in getFixupNoBits

Detailed report: https://oss-fuzz.com/testcase?key=5695931230453760 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmhex Fuzz target binary: fuzzasmhex Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: getFixupNoBits...

keystone/fuzz_asm_arm_thumbv8: Use-of-uninitialized-value in llvm_ks::ARMAsmBackend::adjustFixupValue

Detailed report: https://oss-fuzz.com/testcase?key=5180495577481216 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmarmthumbv8 Fuzz target binary: fuzzasmarmthumbv8 Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

keystone/fuzz_asm_x86_32: Use-of-uninitialized-value in llvm_ks::isIntN

Detailed report: https://oss-fuzz.com/testcase?key=5633466098515968 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmx8632 Fuzz target binary: fuzzasmx8632 Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: llvmks::isIntN...

keystone/fuzz_asm_mips64be: Use-of-uninitialized-value in adjustFixupValue

Detailed report: https://oss-fuzz.com/testcase?key=5680137981394944 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmmips64be Fuzz target binary: fuzzasmmips64be Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: adjustFixupValue...

keystone/fuzz_asm_arm_thumbv8: Use-of-uninitialized-value in llvm_ks::ARMAsmBackend::reasonForFixupRelaxation

Detailed report: https://oss-fuzz.com/testcase?key=5748284482650112 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmarmthumbv8 Fuzz target binary: fuzzasmarmthumbv8 Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

47pages-keystone (>=0.0.1, <=0.0.5), @abtnode/mongoose-nedb (1.0.16) +1539 more potentially affected by CVE-2018-16490 via mpath (>=0.1.1, <=0.5.0)

mpath NPM version =0.1.1, =0.0.1, =0.0.1, =0.7.15, =1.0.7, =0.0.0-alpha.1, =0.0.0, =0.0.1, =2.0.8, =1.2.17, =0.7.6-1, =0.7.6 and more Source cves: CVE-2018-16490 Source advisory: GHSA-H466-J336-74WX...

Security Bulletin: PowerVC is affected by an Openstack Keystone vulnerability that could allow a remote authenticated attacker to discover restricted projects (CVE-2018-14432)

Summary PowerVC has addressed the following vulnerability. An authenticated "GET /v3/OS-FEDERATION/projects" request to the identity API may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects ...

Information Disclosure

openstack-keystone is vulnerable to information disclosure. An authorization bypass on the listing projects via an authenticated GET /v3/OS-FEDERATION/projects request allows authenticated users to discover projects they have no authority to access, disclosing the project and attributes informati...

Authorization Bypass

openstack-keystone is vulnerable to authorization bypass attacks. The vulnerability exists as an authorization-check flaw was discovered in federation configurations of the OpenStack Identity service keystone. An authenticated federated user could request permissions to a project and...