Vulnerability in OpenStack Keystone
CVE-2019-19687
OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.018 (77.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 78th percentile — 77.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.018 · newest: 0.018 · change: 0.000
Affected products
- OpenStack Keystone — versions 15.0.0, 16.0.0
Weakness classification (CWE)
References
- bugs.launchpad.net/keystone/+bug/1855080 (Exploit, Third Party Advisory)
- review.opendev.org/ (Patch, Third Party Advisory)
- review.opendev.org/ (Patch, Third Party Advisory)
- review.opendev.org/ (Patch, Third Party Advisory)
- security.openstack.org/ossa/OSSA-2019-006.html (Vendor Advisory)
- www.openwall.com/lists/oss-security/2019/12/11/8 (mailing-list, Third Party Advisory)
- access.redhat.com/errata/RHSA-2019:4358 (vendor-advisory)
- usn.ubuntu.com/4262-1/ (vendor-advisory)
Frequently asked questions
- What is CVE-2019-19687?
- CVE-2019-19687 is a high-severity vulnerability in OpenStack Keystone, classified under Insufficiently Protected Credentials. CVSS score: 8.8/10. Published 2019-12-09.
- How severe is CVE-2019-19687?
- High severity. CVSS v3 base score is 8.8 out of 10.