Skip to content
Heist/ feed
UnratedFix available

UBUNTU-CVE-2020-12690

Type: advisorySource: OSV1 source record

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.

Announced Source revision 1
Original source ↗

UBUNTU-CVE-2020-12690

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:UBUNTU-CVE-2020-12690

keystone

Source reference: /affected/0/package/name

Affected versions
2:8.0.0-0ubuntu1

Source reference: /affected/0/versions

2:9.0.0~b1-0ubuntu1

Source reference: /affected/0/versions

2:9.0.0~b2-0ubuntu1

Source reference: /affected/0/versions

2:9.0.0~b3-0ubuntu1

Source reference: /affected/0/versions

2:9.0.0~rc1-0ubuntu1

Source reference: /affected/0/versions

2:9.0.0-0ubuntu1

Source reference: /affected/0/versions

2:9.0.2-0ubuntu1

Source reference: /affected/0/versions

2:9.0.2-0ubuntu2

Source reference: /affected/0/versions

2:9.1.0-0ubuntu1

Source reference: /affected/0/versions

2:9.2.0-0ubuntu1

Source reference: /affected/0/versions

2:9.3.0-0ubuntu1

Source reference: /affected/0/versions

2:9.3.0-0ubuntu2

Source reference: /affected/0/versions

2:9.3.0-0ubuntu3

Source reference: /affected/0/versions

2:9.3.0-0ubuntu3.1

Source reference: /affected/0/versions

2:9.3.0-0ubuntu3.2

Source reference: /affected/0/versions

2:9.3.0-0ubuntu3.2+esm2

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

keystone

Source reference: /affected/1/package/name

Affected versions
2:12.0.0-0ubuntu1

Source reference: /affected/1/versions

2:13.0.0~b1-0ubuntu1

Source reference: /affected/1/versions

2:13.0.0~b2-0ubuntu1

Source reference: /affected/1/versions

2:13.0.0~b3-0ubuntu1

Source reference: /affected/1/versions

2:13.0.0~rc1-0ubuntu1

Source reference: /affected/1/versions

2:13.0.0~rc2-0ubuntu1

Source reference: /affected/1/versions

2:13.0.0-0ubuntu1

Source reference: /affected/1/versions

2:13.0.1-0ubuntu1

Source reference: /affected/1/versions

2:13.0.2-0ubuntu1

Source reference: /affected/1/versions

2:13.0.2-0ubuntu3

Source reference: /affected/1/versions

Fixed versions
2:13.0.4-0ubuntu1

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "keystone",
      "purl": "pkg:deb/ubuntu/keystone?arch=source&distro=esm-infra-legacy%2Fxenial",
      "ecosystem": "Ubuntu:Pro:16.04:LTS"
    },
    "versions": [
      "2:8.0.0-0ubuntu1",
      "2:9.0.0~b1-0ubuntu1",
      "2:9.0.0~b2-0ubuntu1",
      "2:9.0.0~b3-0ubuntu1",
      "2:9.0.0~rc1-0ubuntu1",
      "2:9.0.0-0ubuntu1",
      "2:9.0.2-0ubuntu1",
      "2:9.0.2-0ubuntu2",
      "2:9.1.0-0ubuntu1",
      "2:9.2.0-0ubuntu1",
      "2:9.3.0-0ubuntu1",
      "2:9.3.0-0ubuntu2",
      "2:9.3.0-0ubuntu3",
      "2:9.3.0-0ubuntu3.1",
      "2:9.3.0-0ubuntu3.2",
      "2:9.3.0-0ubuntu3.2+esm2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-12690.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "keystone",
          "binary_version": "2:9.3.0-0ubuntu3.2+esm2"
        },
        {
          "binary_name": "python-keystone",
          "binary_version": "2:9.3.0-0ubuntu3.2+esm2"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2:13.0.4-0ubuntu1"
          }
        ]
      }
    ],
    "package": {
      "name": "keystone",
      "purl": "pkg:deb/ubuntu/keystone?arch=source&distro=bionic",
      "ecosystem": "Ubuntu:18.04:LTS"
    },
    "versions": [
      "2:12.0.0-0ubuntu1",
      "2:13.0.0~b1-0ubuntu1",
      "2:13.0.0~b2-0ubuntu1",
      "2:13.0.0~b3-0ubuntu1",
      "2:13.0.0~rc1-0ubuntu1",
      "2:13.0.0~rc2-0ubuntu1",
      "2:13.0.0-0ubuntu1",
      "2:13.0.1-0ubuntu1",
      "2:13.0.2-0ubuntu1",
      "2:13.0.2-0ubuntu3"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-12690.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "keystone",
          "binary_version": "2:13.0.4-0ubuntu1"
        },
        {
          "binary_name": "python-keystone",
          "binary_version": "2:13.0.4-0ubuntu1"
        }
      ],
      "availability": "No subscription required"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#46222 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement