Skip to content
Heist/ feed
UnratedFix available

UBUNTU-CVE-2020-12692

Type: advisorySource: OSV1 source record

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.

Announced Group revision 1
Original source ↗

UBUNTU-CVE-2020-12692

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:UBUNTU-CVE-2020-12692

keystone

Source reference: /affected/0/package/name

Affected versions
2:8.0.0-0ubuntu1

Source reference: /affected/0/versions

2:9.0.0~b1-0ubuntu1

Source reference: /affected/0/versions

2:9.0.0~b2-0ubuntu1

Source reference: /affected/0/versions

2:9.0.0~b3-0ubuntu1

Source reference: /affected/0/versions

2:9.0.0~rc1-0ubuntu1

Source reference: /affected/0/versions

2:9.0.0-0ubuntu1

Source reference: /affected/0/versions

2:9.0.2-0ubuntu1

Source reference: /affected/0/versions

2:9.0.2-0ubuntu2

Source reference: /affected/0/versions

2:9.1.0-0ubuntu1

Source reference: /affected/0/versions

2:9.2.0-0ubuntu1

Source reference: /affected/0/versions

2:9.3.0-0ubuntu1

Source reference: /affected/0/versions

2:9.3.0-0ubuntu2

Source reference: /affected/0/versions

2:9.3.0-0ubuntu3

Source reference: /affected/0/versions

2:9.3.0-0ubuntu3.1

Source reference: /affected/0/versions

2:9.3.0-0ubuntu3.2

Source reference: /affected/0/versions

2:9.3.0-0ubuntu3.2+esm2

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

keystone

Source reference: /affected/1/package/name

Affected versions
2:12.0.0-0ubuntu1

Source reference: /affected/1/versions

2:13.0.0~b1-0ubuntu1

Source reference: /affected/1/versions

2:13.0.0~b2-0ubuntu1

Source reference: /affected/1/versions

2:13.0.0~b3-0ubuntu1

Source reference: /affected/1/versions

2:13.0.0~rc1-0ubuntu1

Source reference: /affected/1/versions

2:13.0.0~rc2-0ubuntu1

Source reference: /affected/1/versions

2:13.0.0-0ubuntu1

Source reference: /affected/1/versions

2:13.0.1-0ubuntu1

Source reference: /affected/1/versions

2:13.0.2-0ubuntu1

Source reference: /affected/1/versions

2:13.0.2-0ubuntu3

Source reference: /affected/1/versions

Fixed versions
2:13.0.4-0ubuntu1

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "keystone",
      "purl": "pkg:deb/ubuntu/keystone?arch=source&distro=esm-infra-legacy%2Fxenial",
      "ecosystem": "Ubuntu:Pro:16.04:LTS"
    },
    "versions": [
      "2:8.0.0-0ubuntu1",
      "2:9.0.0~b1-0ubuntu1",
      "2:9.0.0~b2-0ubuntu1",
      "2:9.0.0~b3-0ubuntu1",
      "2:9.0.0~rc1-0ubuntu1",
      "2:9.0.0-0ubuntu1",
      "2:9.0.2-0ubuntu1",
      "2:9.0.2-0ubuntu2",
      "2:9.1.0-0ubuntu1",
      "2:9.2.0-0ubuntu1",
      "2:9.3.0-0ubuntu1",
      "2:9.3.0-0ubuntu2",
      "2:9.3.0-0ubuntu3",
      "2:9.3.0-0ubuntu3.1",
      "2:9.3.0-0ubuntu3.2",
      "2:9.3.0-0ubuntu3.2+esm2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-12692.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "keystone",
          "binary_version": "2:9.3.0-0ubuntu3.2+esm2"
        },
        {
          "binary_name": "python-keystone",
          "binary_version": "2:9.3.0-0ubuntu3.2+esm2"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2:13.0.4-0ubuntu1"
          }
        ]
      }
    ],
    "package": {
      "name": "keystone",
      "purl": "pkg:deb/ubuntu/keystone?arch=source&distro=bionic",
      "ecosystem": "Ubuntu:18.04:LTS"
    },
    "versions": [
      "2:12.0.0-0ubuntu1",
      "2:13.0.0~b1-0ubuntu1",
      "2:13.0.0~b2-0ubuntu1",
      "2:13.0.0~b3-0ubuntu1",
      "2:13.0.0~rc1-0ubuntu1",
      "2:13.0.0~rc2-0ubuntu1",
      "2:13.0.0-0ubuntu1",
      "2:13.0.1-0ubuntu1",
      "2:13.0.2-0ubuntu1",
      "2:13.0.2-0ubuntu3"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-12692.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "keystone",
          "binary_version": "2:13.0.4-0ubuntu1"
        },
        {
          "binary_name": "python-keystone",
          "binary_version": "2:13.0.4-0ubuntu1"
        }
      ],
      "availability": "No subscription required"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#46223 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

Revision history

  1. UBUNTU-CVE-2020-12692 · Revision 1Source updated