Incorrect role assignment with federated Keystone (CVE-2017-2673) (OSSA-2017-004)
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Mirantis OpenStack |
Won't Fix
|
High
|
MOS Keystone | ||
| 7.0.x |
Invalid
|
High
|
MOS Maintenance | ||
| 8.0.x |
Invalid
|
High
|
MOS Maintenance | ||
| 9.x |
Fix Released
|
High
|
MOS Keystone | ||
Bug Description
Title: Incorrect role assignment with federated Keystone
Reporter: Boris Bobrov (Mail.Ru)
Products: Keystone
Affects: ==11.0.0
Description:
Boris Bobrov from Mail.Ru reported a vulnerability in Keystone
Federation. An authenticated user may receive all the roles assigned to
the user's project regardless of the federation mapping when there are
rules in which group-based assignments are not used. For example, by
requesting an admin user to get a role in their project, the user may be
granted the admin privileges for new scoped tokens. All setups using the
Keystone federation with projects auto-provisioning and no group based
assignments rules are affected.
Proposed patch:
See attached patches. Unless a flaw is discovered in them, these patches
will be merged to their corresponding branches on the public disclosure date.
CVE: CVE-2017-2673
Proposed public disclosure date/time:
2017-04-12, 1500UTC
Please do not make the issue public (or release public patches) before
this coordinated embargo date.
CVE References
| summary: |
- [pre-OSSA] Vulnerability in OpenStack Keystone (CVE-2017-2673) + Incorrect role assignment with federated Keystone (CVE-2017-2673) |
| description: | updated |
| Denis Meltsaykin (dmeltsaykin) wrote Re: Incorrect role assignment with federated Keystone (CVE-2017-2673) | #1 |
| Changed in mos: | |
| milestone: | none → 10.0 |
| status: | New → Confirmed |
| Adam Heczko (aheczko-mirantis) wrote | #2 |
| Adam Heczko (aheczko-mirantis) wrote | #3 |
| Denis Meltsaykin (dmeltsaykin) wrote | #4 |
| Ilya Bumarskov (ibumarskov) wrote | #5 |
| tags: | added: feature-security |
| Changed in mos: | |
| status: | Confirmed → Won't Fix |
| summary: |
Incorrect role assignment with federated Keystone (CVE-2017-2673) + (OSSA-2017-004) |
| Denis Meltsaykin (dmeltsaykin) wrote | #6 |
| Adam Heczko (aheczko-mirantis) wrote | #7 |
| information type: | Private Security → Public Security |
It doesn't seem like we have an appropriate milestone for it, feel free to retarget.