CVE-2017-2673
Fixed in a distro release EPSS 2%CVSS 6.8
An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.
Products: redhat openstack
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | keystone | no fix |
| PyPI | keystone | 10.0.2 |
| PyPI | keystone | 11.0.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | keystone | 2:10.0.0-9 |
| Debian 13 | keystone | 2:10.0.0-9 |
| Debian 14 | keystone | 2:10.0.0-9 |
| Red Hat openstack 10 | openstack-keystone | 1:10.0.1-3.el7ost |
| Red Hat openstack 10 | python-keystone | 1:10.0.1-3.el7ost |
| Red Hat openstack 10 | python-keystone-tests | 1:10.0.1-3.el7ost |
| Red Hat openstack 9 | openstack-keystone | 1:9.3.0-2.el7ost |
| Red Hat openstack 9 | python-keystone | 1:9.3.0-2.el7ost |
| Red Hat openstack 9 | python-keystone-tests | 1:9.3.0-2.el7ost |
| Ubuntu 16.04 LTS | keystone | 2:9.3.0-0ubuntu3.1 |