Homepage

Insufficiently Protected Credentials The advisory has been revoked - it doesn't affect any version of package keystone  (opens in a new tab)

Threat Intelligence

EPSS
1.78% (76th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1804-KEYSTONE-612141
  • published11 Dec 2019
  • disclosed9 Dec 2019
Report a new vulnerability Found a mistake?

Introduced: 9 Dec 2019

CVE-2019-19687  (opens in a new tab)
CWE-522  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:18.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream keystone package and not the keystone package as distributed by Ubuntu.

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)