Ubuntu: Security Advisory (USN-4262-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4262-1: OpenStack Keystone vulnerability

Daniel Preussker discovered that OpenStack Keystone incorrectly handled the list credentials API. A user with a role on the project could use this issue to view any other user's credentials...

CVE-2019-3683

The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access, modify, create and delete...

CVE-2019-3683

The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access, modify, create and delete...

Code injection

The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access, modify, create and delete...

CVE-2019-3683

The CVE-2019-3683 issue affects the keystone-json-assignment package in SUSE Openstack Cloud 8 prior to commit d7888c75505465490250c00cc0ef4bb1af662f9f. The root cause is that every user listed in /etc/keystone/user-project-map.json was granted full member access to every project, enabling these ...

keystone:fuzz_asm_x86_16: Use-of-uninitialized-value in llvm_ks::isIntN

Detailed Report: https://oss-fuzz.com/testcase?key=5739616535838720 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmx8616 Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: llvmks::isIntN X86AsmBackend::applyFixup...

keystone:fuzz_asm_x86_32: Bad-cast to llvm_ks::X86OperandX86AsmParser::MatchAndEmitATTInstruction in AsmParser::parseStatement

Detailed Report: https://oss-fuzz.com/testcase?key=5742122011721728 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmx8632 Job Type: libfuzzerubsankeystone Platform Id: linux Crash Type: Bad-cast Crash Address: 0x00000260e160 Crash State: Bad-cast to...

keystone:fuzz_asm_mipsbe: Use-of-uninitialized-value in MipsAsmParser::isPicAndNotNxxAbi

Detailed Report: https://oss-fuzz.com/testcase?key=5086719271763968 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmmipsbe Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: MipsAsmParser::isPicAndNotNxxAbi...

keystone:fuzz_asm_sparcbe: Use-of-uninitialized-value in llvm_ks::MCAssembler::computeFragmentSize

Detailed Report: https://oss-fuzz.com/testcase?key=5656891841839104 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmsparcbe Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: llvmks::MCAssembler::computeFragmentSiz...

keystone:fuzz_asm_sparc64be: Heap-buffer-overflow in ELFSparcAsmBackend::applyFixup

Detailed Report: https://oss-fuzz.com/testcase?key=5081419969986560 Project: keystone Fuzzing Engine: afl Fuzz Target: fuzzasmsparc64be Job Type: aflasankeystone Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6070000000d1 Crash State: ELFSparcAsmBackend::applyFixup...

keystone:fuzz_asm_x86_16: Use-of-uninitialized-value in X86AsmParser::ParseIntelOperand

Detailed Report: https://oss-fuzz.com/testcase?key=5746148690362368 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmx8616 Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: X86AsmParser::ParseIntelOperand...

openstack-keystone: Credentials API allows non-admin to list and retrieve all users credentials

A disclosure vulnerability was found in openstack-keystone's credentials API. Users with a project role are able to list any credentials with the /v3/credentials API when enforcescope is false. Information for time-based one time passwords TOTP may also be disclosed. Deployments running keystone...

CVE-2019-19687

A disclosure vulnerability was found in openstack-keystone's credentials API. Users with a project role are able to list any credentials with the /v3/credentials API when enforcescope is false. Information for time-based one time passwords TOTP may also be disclosed. Deployments running keystone...

DEBIAN-CVE-2013-2166

python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass...

DEBIAN-CVE-2013-2167

python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass...

PYSEC-2019-161

python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass...

Information Disclosure

openstack keystone is vulnerable to information disclosure. Any authenticated user is able to list the credentials of any user using the /v3/credentials API when enforcescope is set to false. The leaked credentials include sign-on information for Time-based OTP...

OpenStack Keystone has an unspecified vulnerability

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration NASA in collaboration with Rackspace in the U.S. OpenStack Keystone is a module used in OpenStack to manage the authentication, service rules, and service token functions. A security...

DEBIAN-CVE-2019-19687

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforcescope is false. Users with a role on a project are able to view any other users' credentials,...