gsd-2020-12690
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2020-12690",
"description": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.",
"id": "GSD-2020-12690",
"references": [
"https://www.suse.com/security/cve/CVE-2020-12690.html",
"https://access.redhat.com/errata/RHSA-2020:3105",
"https://access.redhat.com/errata/RHSA-2020:3102",
"https://ubuntu.com/security/CVE-2020-12690"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2020-12690"
],
"details": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.",
"id": "GSD-2020-12690",
"modified": "2023-12-13T01:21:49.432728Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-12690",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://security.openstack.org/ossa/OSSA-2020-005.html",
"refsource": "CONFIRM",
"url": "https://security.openstack.org/ossa/OSSA-2020-005.html"
},
{
"name": "https://bugs.launchpad.net/keystone/+bug/1873290",
"refsource": "MISC",
"url": "https://bugs.launchpad.net/keystone/+bug/1873290"
},
{
"name": "https://www.openwall.com/lists/oss-security/2020/05/06/6",
"refsource": "MISC",
"url": "https://www.openwall.com/lists/oss-security/2020/05/06/6"
},
{
"name": "[oss-security] 20200507 Re: [OSSA-2020-005] Keystone: OAuth1 request token authorize silently ignores roles parameter (CVE PENDING)",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2020/05/07/3"
},
{
"name": "[druid-commits] 20200520 [GitHub] [druid] ccaominh opened a new pull request #9903: Suppress CVEs for openstack-keystone",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2@%3Ccommits.druid.apache.org%3E"
},
{
"name": "USN-4480-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4480-1/"
},
{
"name": "[druid-commits] 20210712 [druid] branch master updated: Suppress CVE-2021-27568 from json-smart 2.3 dependency (#11438)",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/re237267da268c690df5e1c6ea6a38a7fc11617725e8049490f58a6fa@%3Ccommits.druid.apache.org%3E"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003c15.0.1||\u003e=16.0.0.0rc1,\u003c16.0.0",
"affected_versions": "All versions before 15.0.1, all versions starting from 16.0.0.0rc1 before 16.0.0",
"cvss_v2": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-613",
"CWE-937"
],
"date": "2021-07-14",
"description": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.",
"fixed_versions": [
"15.0.1",
"16.0.0"
],
"identifier": "CVE-2020-12690",
"identifiers": [
"GHSA-6m8p-x4qw-gh5j",
"CVE-2020-12690"
],
"not_impacted": "All versions starting from 15.0.1 before 16.0.0.0rc1, all versions starting from 16.0.0",
"package_slug": "pypi/keystone",
"pubdate": "2021-06-09",
"solution": "Upgrade to versions 15.0.1, 16.0.0 or above.",
"title": "Insufficient Session Expiration",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-12690",
"https://bugs.launchpad.net/keystone/+bug/1873290",
"https://lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2@%3Ccommits.druid.apache.org%3E",
"https://security.openstack.org/ossa/OSSA-2020-005.html",
"https://usn.ubuntu.com/4480-1/",
"https://www.openwall.com/lists/oss-security/2020/05/06/6",
"http://www.openwall.com/lists/oss-security/2020/05/07/3",
"https://github.com/advisories/GHSA-6m8p-x4qw-gh5j"
],
"uuid": "d01cf0b1-c769-4bc8-8814-0cb2eee45604"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "15.0.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:openstack:keystone:16.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-12690"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-613"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugs.launchpad.net/keystone/+bug/1873290",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://bugs.launchpad.net/keystone/+bug/1873290"
},
{
"name": "https://www.openwall.com/lists/oss-security/2020/05/06/6",
"refsource": "MISC",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://www.openwall.com/lists/oss-security/2020/05/06/6"
},
{
"name": "[oss-security] 20200507 Re: [OSSA-2020-005] Keystone: OAuth1 request token authorize silently ignores roles parameter (CVE PENDING)",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2020/05/07/3"
},
{
"name": "https://security.openstack.org/ossa/OSSA-2020-005.html",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "https://security.openstack.org/ossa/OSSA-2020-005.html"
},
{
"name": "[druid-commits] 20200520 [GitHub] [druid] ccaominh opened a new pull request #9903: Suppress CVEs for openstack-keystone",
"refsource": "MLIST",
"tags": [],
"url": "https://lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2@%3Ccommits.druid.apache.org%3E"
},
{
"name": "USN-4480-1",
"refsource": "UBUNTU",
"tags": [],
"url": "https://usn.ubuntu.com/4480-1/"
},
{
"name": "[druid-commits] 20210712 [druid] branch master updated: Suppress CVE-2021-27568 from json-smart 2.3 dependency (#11438)",
"refsource": "MLIST",
"tags": [],
"url": "https://lists.apache.org/thread.html/re237267da268c690df5e1c6ea6a38a7fc11617725e8049490f58a6fa@%3Ccommits.druid.apache.org%3E"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
},
"lastModifiedDate": "2021-07-13T05:15Z",
"publishedDate": "2020-05-07T00:15Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.