Data Leakage Vulnerability in OpenStack Keystone: Credentials Exposure
Summary
CVE-2019-19687: OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Affects keystone across 3 version ranges.
< 2:16.0.0-5
< c78581b4608f3dc10e945d358963000f284f188a
< dc9e9e32dfbf9fd9c58f9f8e2b35f0bcfd62328e
Fixed in 2:16.0.0-5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Keystone is an essential component of the OpenStack cloud computing platform, providing identity services for authentication and authorization. It enables users to manage access to cloud resources through a centralized service. However, certain configurations can expose sensitive information, particularly when the 'enforce_scope' setting is disabled, leading to potential data leakage.
Vulnerability Detail
The vulnerability identified as CVE-2019-19687 affects OpenStack Keystone versions 15.0.0 and 16.0.0, allowing any user with a role on a project to list credentials through the /v3/credentials API when 'enforce_scope' is set to false. This misconfiguration permits users to view other users' credentials, including sensitive sign-on information for Time-based One Time Passwords (TOTP). The risk is heightened in deployments where this setting is not enforced, potentially leading to unauthorized access and data breaches.
How To Fix
Minimum fixed version
2:16.0.0-5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade keystoneTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the 'enforce_scope' configuration is set to true in your Keystone configuration file. This can be done by modifying the 'keystone.conf' file:
- Open the configuration file:
sudo nano /etc/keystone/keystone.conf
-
Locate the 'enforce_scope' setting and set it to true: enforce_scope = true
-
Save the changes and restart the Keystone service:
sudo systemctl restart keystone
Conclusion
The CVE-2019-19687 vulnerability poses a significant risk to OpenStack Keystone deployments where the 'enforce_scope' setting is disabled. It is essential to apply the recommended updates and configurations to mitigate the risk of data leakage and unauthorized access to sensitive credentials.
See every vulnerability recorded for keystone →
FAQ
CVE-2019-19687 is a vulnerability in OpenStack Keystone that allows users to list other users' credentials when 'enforce_scope' is disabled.
The vulnerability can lead to unauthorized access to sensitive information, including Time-based One Time Passwords (TOTP), which can compromise user accounts.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
OpenStack Keystone versions 15.0.0 and 16.0.0 are affected by this vulnerability.
The CVSS score of CVE-2019-19687 is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
