cve-2019-19687
Vulnerability from cvelistv5
Published
2019-12-09 17:14
Modified
2024-08-05 02:25
Severity ?
Summary
OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2019/12/11/8Third Party Advisory
cve@mitre.orghttps://access.redhat.com/errata/RHSA-2019:4358
cve@mitre.orghttps://bugs.launchpad.net/keystone/+bug/1855080Exploit, Third Party Advisory
cve@mitre.orghttps://review.opendev.org/#/c/697355/Patch, Third Party Advisory
cve@mitre.orghttps://review.opendev.org/#/c/697611/Patch, Third Party Advisory
cve@mitre.orghttps://review.opendev.org/#/c/697731/Patch, Third Party Advisory
cve@mitre.orghttps://security.openstack.org/ossa/OSSA-2019-006.htmlVendor Advisory
cve@mitre.orghttps://usn.ubuntu.com/4262-1/
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2019/12/11/8Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2019:4358
af854a3a-2127-422b-91ae-364da2661108https://bugs.launchpad.net/keystone/+bug/1855080Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://review.opendev.org/#/c/697355/Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://review.opendev.org/#/c/697611/Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://review.opendev.org/#/c/697731/Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.openstack.org/ossa/OSSA-2019-006.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4262-1/
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T02:25:12.373Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.launchpad.net/keystone/+bug/1855080"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://review.opendev.org/#/c/697355/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://review.opendev.org/#/c/697611/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://review.opendev.org/#/c/697731/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.openstack.org/ossa/OSSA-2019-006.html"
          },
          {
            "name": "[oss-security] 20191211 [OSSA-2019-006] Keystone: Credentials API allows listing and retrieving of all users credentials (CVE-2019-19687)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2019/12/11/8"
          },
          {
            "name": "RHSA-2019:4358",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:4358"
          },
          {
            "name": "USN-4262-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4262-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users\u0027 credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-31T13:06:07",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.launchpad.net/keystone/+bug/1855080"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://review.opendev.org/#/c/697355/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://review.opendev.org/#/c/697611/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://review.opendev.org/#/c/697731/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.openstack.org/ossa/OSSA-2019-006.html"
        },
        {
          "name": "[oss-security] 20191211 [OSSA-2019-006] Keystone: Credentials API allows listing and retrieving of all users credentials (CVE-2019-19687)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2019/12/11/8"
        },
        {
          "name": "RHSA-2019:4358",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:4358"
        },
        {
          "name": "USN-4262-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4262-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-19687",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users\u0027 credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugs.launchpad.net/keystone/+bug/1855080",
              "refsource": "MISC",
              "url": "https://bugs.launchpad.net/keystone/+bug/1855080"
            },
            {
              "name": "https://review.opendev.org/#/c/697355/",
              "refsource": "MISC",
              "url": "https://review.opendev.org/#/c/697355/"
            },
            {
              "name": "https://review.opendev.org/#/c/697611/",
              "refsource": "MISC",
              "url": "https://review.opendev.org/#/c/697611/"
            },
            {
              "name": "https://review.opendev.org/#/c/697731/",
              "refsource": "MISC",
              "url": "https://review.opendev.org/#/c/697731/"
            },
            {
              "name": "https://security.openstack.org/ossa/OSSA-2019-006.html",
              "refsource": "CONFIRM",
              "url": "https://security.openstack.org/ossa/OSSA-2019-006.html"
            },
            {
              "name": "[oss-security] 20191211 [OSSA-2019-006] Keystone: Credentials API allows listing and retrieving of all users credentials (CVE-2019-19687)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2019/12/11/8"
            },
            {
              "name": "RHSA-2019:4358",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:4358"
            },
            {
              "name": "USN-4262-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4262-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-19687",
    "datePublished": "2019-12-09T17:14:14",
    "dateReserved": "2019-12-09T00:00:00",
    "dateUpdated": "2024-08-05T02:25:12.373Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2019-19687\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-12-09T18:15:09.827\",\"lastModified\":\"2024-11-21T04:35:11.607\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users\u0027 credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)\"},{\"lang\":\"es\",\"value\":\"OpenStack Keystone versiones 15.0.0 y 16.0.0, est\u00e1 afectado por un Filtrado de Datos en la API de credenciales de lista. Cualquier usuario con un rol en un proyecto es capaz de enumerar cualquier credencial con la API de /v3/credentials cuando la funci\u00f3n enforce_scope es falsa. Los usuarios con un rol en un proyecto pueden visualizar las credenciales de cualquier otro usuario, lo que podr\u00eda (por ejemplo) filtrar informaci\u00f3n de inicio de sesi\u00f3n de Time-based One Time Passwords (TOTP). Las implementaciones con la funci\u00f3n enforce_scope establecida en false est\u00e1n afectadas. (Habr\u00e1 un ligero impacto en el rendimiento de la API de credenciales de lista una vez que este problema sea corregido).\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:P/I:N/A:N\",\"baseScore\":3.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-522\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openstack:keystone:15.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9FD05D79-A4D5-46A7-9F88-DF945A2B26A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openstack:keystone:16.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"71945B91-B12D-4EF4-AE03-91592D434125\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2019/12/11/8\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:4358\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://bugs.launchpad.net/keystone/+bug/1855080\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://review.opendev.org/#/c/697355/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://review.opendev.org/#/c/697611/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://review.opendev.org/#/c/697731/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://security.openstack.org/ossa/OSSA-2019-006.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4262-1/\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2019/12/11/8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:4358\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugs.launchpad.net/keystone/+bug/1855080\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://review.opendev.org/#/c/697355/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://review.opendev.org/#/c/697611/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://review.opendev.org/#/c/697731/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://security.openstack.org/ossa/OSSA-2019-006.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4262-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.