Debian dla-3714 : keystone - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3714 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3714-1 [email protected]...

Debian: Security Advisory (DLA-3714-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3714-1] keystone security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3714-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès January 21, 2024 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 3713-1] subunit bugfix update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3713-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès January 21, 2024 https://wiki.debian.org/LTS -...

DLA-3714-1 keystone - security update

Bulletin has no description...

Incorrect Authorization

openstack-keystone is vulnerable to Incorrect Authorization. The vulnerability is caused due to a flaw where only the first 72 characters of an application secret are verified. This allows attackers to bypass some password complexity which administrators may be counting on leading to compromising...

keystone-historic-buildings.com Improper Access Control vulnerability OBB-3802627

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

keystonenegotiation.com Improper Access Control vulnerability OBB-3802628

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Improper Access Control

@keystone-6/core is vulnerable to Improper Access Control. The vulnerability exists when the ui.isAccessAllowed parameter in the KeystoneMeta function of adminMetaSchema.ts is set as undefined, which allows an attacker to access the admin meta GraphQL query if the session strategy is not defined...

@story-telling-reporter/draft-editor (>=2.1.0-beta.0, <=2.1.2) potentially affected by CVE-2023-40027 via @keystone-6/core (5.2.0)

@keystone-6/core NPM version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on @keystone-6/core and may be impacted: - @story-telling-reporter/draft-editor =2.1.0-beta.0, =2.1.2 Source cves: CVE-2023-40027 Source advisory: GHSA-9CVC-V7WM-992C...

@story-telling-reporter/draft-editor (>=2.1.0-beta.0, <=2.1.2) potentially affected by CVE-2023-40027 via @keystone-6/core (5.2.0)

@keystone-6/core NPM version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on @keystone-6/core and may be impacted: - @story-telling-reporter/draft-editor =2.1.0-beta.0, =2.1.2 Source cves: CVE-2023-40027 Source advisory: OSV:GHSA-9CVC-V7WM-992C...

GHSA-9CVC-V7WM-992C When `ui.isAccessAllowed` is `undefined`, the `adminMeta` GraphQL query is publicly accessible

Summary When ui.isAccessAllowed is undefined, the adminMeta GraphQL query is publicly accessible, that is to say, no session is required for the query. This is different to the behaviour of the default AdminUI middleware, which by default will only be publicly accessible if a session strategy is...

Default configuration

Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When ui.isAccessAllowed is set as undefined, the adminMeta GraphQL query is publicly accessible no session required. This is different to the behaviour of the default AdminUI middleware, which by default will only...

CVE-2023-40027

Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When ui.isAccessAllowed is set as undefined, the adminMeta GraphQL query is publicly accessible no session required. This is different to the behaviour of the default AdminUI middleware, which by default will only...

@beemstream/keystone-document-gallery (>=2.0.0, <=2.0.6), @murz/keystone-field-nested-set (4.0.1-1) +7 more potentially affected by CVE-2023-40027 via @keystone-6/core (>=1.1.1, <=5.2.0)

@keystone-6/core NPM version =1.1.1, =2.0.0, =2.1.0-beta.0, =1.0.0, =6.0.21, =0.0.1, =1.0.0, =0.0.1, =0.1.0, =0.2.0 Source cves: CVE-2023-40027 Source advisory: MEND:CVE-2023-40027...

CVE-2023-40027 Conditionally missing authorization in @keystone-6/core

Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When ui.isAccessAllowed is set as undefined, the adminMeta GraphQL query is publicly accessible no session required. This is different to the behaviour of the default AdminUI middleware, which by default will only...

CVE-2023-40027 Conditionally missing authorization in @keystone-6/core

Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When ui.isAccessAllowed is set as undefined, the adminMeta GraphQL query is publicly accessible no session required. This is different to the behaviour of the default AdminUI middleware, which by default will only...

CVE-2023-40027 Conditionally missing authorization in @keystone-6/core

Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When ui.isAccessAllowed is set as undefined, the adminMeta GraphQL query is publicly accessible no session required. This is different to the behaviour of the default AdminUI middleware, which by default will only...

CVE-2023-40027

Keystone (Node.js) vulnerability CVE-2023-40027: When ui.isAccessAllowed is undefined, the adminMeta GraphQL query is publicly accessible without a session, potentially exposing admin metadata. Affected users are those relying on a session strategy to restrict access; developers using @keystone-6...

Keystone security vulnerabilities

Keystone is a powerful OpenStack open source CMS designed to help you build and scale faster than any other Cms or application framework. Keystone has a security vulnerability that stems from adminMeta GraphQL queries being publicly accessible when ui.isAccessAllowed is set to undefined...