CVE-2020-12689

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.
Any user authenticated within a limited scope (trust/oauth/application
credential) can create an EC2 credential with an escalated permission, such
as obtaining admin while the user is on a limited viewer role. This
potentially allows a malicious user to act as the admin on a project
another user has the admin role on, which can effectively grant that user
global admin privileges.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=959900&gt;
• <https://bugs.launchpad.net/keystone/+bug/1872735&gt;