CVE-2020-12690
Summary
| CVE | CVE-2020-12690 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-05-07 00:15:00 UTC |
| Updated | 2023-11-07 03:15:00 UTC |
| Description | An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access. |
Risk And Classification
Problem Types: CWE-613
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| OpenStack Docs: OSSA-2020-005: OAuth1 request token authorize silently ignores roles parameter | CONFIRM | security.openstack.org | Vendor Advisory |
| oss-security - [OSSA-2020-005] Keystone: OAuth1 request token authorize silently ignores roles parameter (CVE PENDING) | MISC | www.openwall.com | Mailing List, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | |
| Bug #1873290 “[OSSA-2020-005] OAuth1 request token authorize sil...” : Bugs : OpenStack Identity (keystone) | MISC | bugs.launchpad.net | Patch, Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | |
| [druid-commits] 20210712 [druid] branch master updated: Suppress CVE-2021-27568 from json-smart 2.3 dependency (#11438) | lists.apache.org | ||
| oss-security - Re: [OSSA-2020-005] Keystone: OAuth1 request token authorize silently ignores roles parameter (CVE PENDING) | MLIST | www.openwall.com | Mailing List, Third Party Advisory |
| USN-4480-1: OpenStack Keystone vulnerabilities | Ubuntu security notices | Ubuntu | UBUNTU | usn.ubuntu.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 982009 Python (pip) Security Update for keystone (GHSA-6m8p-x4qw-gh5j)