CVE-2018-14432
Fixed in a distro release EPSS 2%
In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.
Products: debian_linux, redhat openstack, openstack keystone
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | keystone | 2:13.0.0-7 |
| Debian 13 | keystone | 2:13.0.0-7 |
| Debian 14 | keystone | 2:13.0.0-7 |
| Debian 9 | keystone | 2:10.0.0-9+deb9u1 |
| Red Hat openstack 10 | openstack-keystone | 1:10.0.3-4.el7ost |
| Red Hat openstack 10 | python-keystone | 1:10.0.3-4.el7ost |
| Red Hat openstack 10 | python-keystone-tests | 1:10.0.3-4.el7ost |
| Red Hat openstack 12 | openstack-keystone | 1:12.0.0-6.el7ost |
| Red Hat openstack 12 | python-keystone | 1:12.0.0-6.el7ost |
| Red Hat openstack 12 | python-keystone-tests | 1:12.0.0-6.el7ost |
| Red Hat openstack 13 | openstack-keystone | 1:13.0.1-1.el7ost |
| Red Hat openstack 13 | python-keystone | 1:13.0.1-1.el7ost |
| SUSE HPE Helion OpenStack 8 | openstack-aodh | 5.1.1~dev5-3.5.3 |
| SUSE HPE Helion OpenStack 8 | openstack-aodh-doc | 5.1.1~dev5-3.5.4 |
| SUSE HPE Helion OpenStack 8 | openstack-barbican | 5.0.1~dev11-3.8.3 |
| SUSE HPE Helion OpenStack 8 | openstack-barbican-doc | 5.0.1~dev11-3.8.3 |
| SUSE HPE Helion OpenStack 8 | openstack-cinder | 11.1.2~dev14-3.6.3 |
| SUSE HPE Helion OpenStack 8 | openstack-cinder-doc | 11.1.2~dev14-3.6.4 |
| SUSE HPE Helion OpenStack 8 | openstack-dashboard | 12.0.4~dev1-3.8.3 |
| SUSE HPE Helion OpenStack 8 | openstack-designate | 5.0.2~dev5-3.5.3 |
| SUSE HPE Helion OpenStack 8 | openstack-designate-doc | 5.0.2~dev5-3.5.3 |
| SUSE HPE Helion OpenStack 8 | openstack-glance | 15.0.2~dev4-3.3.3 |
| SUSE HPE Helion OpenStack 8 | openstack-glance-doc | 15.0.2~dev4-3.3.3 |
| SUSE HPE Helion OpenStack 8 | openstack-heat | 9.0.5~dev11-3.6.3 |
| SUSE HPE Helion OpenStack 8 | openstack-heat-doc | 9.0.5~dev11-3.6.4 |
| SUSE HPE Helion OpenStack 8 | openstack-heat-templates | 0.0.0+git.1525957319.6b5a7cd-3.3.3 |
| SUSE HPE Helion OpenStack 8 | openstack-horizon-plugin-designate-ui | 5.0.2~dev5-3.3.5 |
| SUSE HPE Helion OpenStack 8 | openstack-horizon-plugin-freezer-ui | 5.0.1~dev6-3.3.5 |
| SUSE HPE Helion OpenStack 8 | openstack-horizon-plugin-gbp-ui | 5.0.1~dev21-4.3.3 |
| SUSE HPE Helion OpenStack 8 | openstack-horizon-plugin-manila-ui | 2.10.3~dev4-4.5.5 |
| SUSE HPE Helion OpenStack 8 | openstack-horizon-plugin-neutron-lbaas-ui | 3.0.3~dev2-3.5.4 |
| SUSE HPE Helion OpenStack 8 | openstack-horizon-plugin-trove-ui | 9.0.1~dev7-3.3.5 |
| SUSE HPE Helion OpenStack 8 | openstack-ironic | 9.1.5~dev7-3.6.3 |
| SUSE HPE Helion OpenStack 8 | openstack-ironic-doc | 9.1.5~dev7-3.6.3 |
| SUSE HPE Helion OpenStack 8 | openstack-keystone | 12.0.1~dev19-5.8.3 |
| SUSE HPE Helion OpenStack 8 | openstack-keystone-doc | 12.0.1~dev19-5.8.3 |
| SUSE HPE Helion OpenStack 8 | openstack-manila | 5.0.2~dev55-3.6.3 |
| SUSE HPE Helion OpenStack 8 | openstack-manila-doc | 5.0.2~dev55-3.6.4 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron | 11.0.6~dev63-3.6.3 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron-doc | 11.0.6~dev63-3.6.3 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron-fwaas | 11.0.2~dev7-3.5.3 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron-fwaas-doc | 11.0.2~dev7-3.5.3 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron-lbaas | 11.0.4~dev4-3.3.4 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron-lbaas-doc | 11.0.4~dev4-3.3.3 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron-vpnaas | 11.0.1~dev1-3.3.3 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron-vpnaas-doc | 11.0.1~dev1-3.3.3 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron-zvm-agent | 8.0.1~dev12-4.3.3 |
| SUSE HPE Helion OpenStack 8 | openstack-nova | 16.1.5~dev49-3.8.4 |
| SUSE HPE Helion OpenStack 8 | openstack-nova-doc | 16.1.5~dev49-3.8.4 |
| SUSE HPE Helion OpenStack 8 | openstack-nova-virt-zvm | 8.0.1~dev56-3.3.4 |
| SUSE HPE Helion OpenStack 8 | openstack-octavia | 1.0.3~dev21-4.6.3 |
| SUSE HPE Helion OpenStack 8 | openstack-trove | 8.0.1~dev11-3.3.3 |
| SUSE HPE Helion OpenStack 8 | openstack-trove-doc | 8.0.1~dev11-3.3.3 |
| SUSE HPE Helion OpenStack 8 | python-barbicanclient | 4.5.2-4.3.2 |
| SUSE HPE Helion OpenStack 8 | python-keystone-json-assignment | 0.0.2-3.3.2 |
| SUSE HPE Helion OpenStack 8 | python-manilaclient | 1.17.3-3.3.2 |
| SUSE HPE Helion OpenStack 8 | python-vmware-nsx | 11.0.3~dev16-3.3.2 |
| SUSE HPE Helion OpenStack 8 | python-vmware-nsxlib | 11.0.4~dev7-3.3.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-aodh | 5.0.1-12.4.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-barbican | 5.0.1-12.5.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-cinder | 11.0.2-14.5.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-designate | 5.0.1-12.3.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-glance | 15.0.1-12.3.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-heat | 9.0.1-12.5.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-horizon-hpe | 11.0.2-14.6.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-ironic | 9.1.3-12.5.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-keystone | 12.0.1-11.5.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-magnum | 5.0.2-11.4.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-manila | 5.0.2-12.5.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-neutron | 11.0.2-13.8.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-nova | 16.0.3-11.6.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-octavia | 1.0.2-12.5.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-sahara | 7.0.1-11.4.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-trove | 8.0.0.0-11.4.1 |
| SUSE OpenStack Cloud 7 | openstack-dashboard | 10.0.6~dev4-4.15.1 |
| SUSE OpenStack Cloud 7 | openstack-heat | 7.0.7~dev10-5.12.1 |
| SUSE OpenStack Cloud 7 | openstack-heat-doc | 7.0.7~dev10-5.12.1 |
| SUSE OpenStack Cloud 7 | openstack-horizon-plugin-designate-ui | 3.0.2~dev1-3.6.1 |
| SUSE OpenStack Cloud 7 | openstack-keystone | 10.0.3~dev9-7.12.1 |
| SUSE OpenStack Cloud 7 | openstack-keystone-doc | 10.0.3~dev9-7.12.1 |
| SUSE OpenStack Cloud 7 | openstack-nova | 14.0.11~dev13-4.25.1 |
| SUSE OpenStack Cloud 7 | openstack-nova-doc | 14.0.11~dev13-4.25.1 |
| SUSE OpenStack Cloud 7 | python-os-vif | 1.2.1-3.3.1 |
| SUSE OpenStack Cloud 8 | openstack-aodh | 5.1.1~dev5-3.5.3 |
| SUSE OpenStack Cloud 8 | openstack-aodh-doc | 5.1.1~dev5-3.5.4 |
| SUSE OpenStack Cloud 8 | openstack-barbican | 5.0.1~dev11-3.8.3 |
| SUSE OpenStack Cloud 8 | openstack-barbican-doc | 5.0.1~dev11-3.8.3 |
| SUSE OpenStack Cloud 8 | openstack-cinder | 11.1.2~dev14-3.6.3 |
| SUSE OpenStack Cloud 8 | openstack-cinder-doc | 11.1.2~dev14-3.6.4 |
| SUSE OpenStack Cloud 8 | openstack-dashboard | 12.0.4~dev1-3.8.3 |
| SUSE OpenStack Cloud 8 | openstack-designate | 5.0.2~dev5-3.5.3 |
| SUSE OpenStack Cloud 8 | openstack-designate-doc | 5.0.2~dev5-3.5.3 |
| SUSE OpenStack Cloud 8 | openstack-glance | 15.0.2~dev4-3.3.3 |
| SUSE OpenStack Cloud 8 | openstack-glance-doc | 15.0.2~dev4-3.3.3 |
| SUSE OpenStack Cloud 8 | openstack-heat | 9.0.5~dev11-3.6.3 |
| SUSE OpenStack Cloud 8 | openstack-heat-doc | 9.0.5~dev11-3.6.4 |
| SUSE OpenStack Cloud 8 | openstack-heat-templates | 0.0.0+git.1525957319.6b5a7cd-3.3.3 |
| SUSE OpenStack Cloud 8 | openstack-horizon-plugin-designate-ui | 5.0.2~dev5-3.3.5 |
| SUSE OpenStack Cloud 8 | openstack-horizon-plugin-freezer-ui | 5.0.1~dev6-3.3.5 |
| SUSE OpenStack Cloud 8 | openstack-horizon-plugin-gbp-ui | 5.0.1~dev21-4.3.3 |
| SUSE OpenStack Cloud 8 | openstack-horizon-plugin-manila-ui | 2.10.3~dev4-4.5.5 |
| SUSE OpenStack Cloud 8 | openstack-horizon-plugin-neutron-lbaas-ui | 3.0.3~dev2-3.5.4 |
| SUSE OpenStack Cloud 8 | openstack-horizon-plugin-trove-ui | 9.0.1~dev7-3.3.5 |
| SUSE OpenStack Cloud 8 | openstack-ironic | 9.1.5~dev7-3.6.3 |
| SUSE OpenStack Cloud 8 | openstack-ironic-doc | 9.1.5~dev7-3.6.3 |
| SUSE OpenStack Cloud 8 | openstack-keystone | 12.0.1~dev19-5.8.3 |
| SUSE OpenStack Cloud 8 | openstack-keystone-doc | 12.0.1~dev19-5.8.3 |
| SUSE OpenStack Cloud 8 | openstack-manila | 5.0.2~dev55-3.6.3 |
| SUSE OpenStack Cloud 8 | openstack-manila-doc | 5.0.2~dev55-3.6.4 |
| SUSE OpenStack Cloud 8 | openstack-neutron | 11.0.6~dev63-3.6.3 |
| SUSE OpenStack Cloud 8 | openstack-neutron-doc | 11.0.6~dev63-3.6.3 |
| SUSE OpenStack Cloud 8 | openstack-neutron-fwaas | 11.0.2~dev7-3.5.3 |
| SUSE OpenStack Cloud 8 | openstack-neutron-fwaas-doc | 11.0.2~dev7-3.5.3 |
| SUSE OpenStack Cloud 8 | openstack-neutron-lbaas | 11.0.4~dev4-3.3.4 |
| SUSE OpenStack Cloud 8 | openstack-neutron-lbaas-doc | 11.0.4~dev4-3.3.3 |
| SUSE OpenStack Cloud 8 | openstack-neutron-vpnaas | 11.0.1~dev1-3.3.3 |
| SUSE OpenStack Cloud 8 | openstack-neutron-vpnaas-doc | 11.0.1~dev1-3.3.3 |
| SUSE OpenStack Cloud 8 | openstack-neutron-zvm-agent | 8.0.1~dev12-4.3.3 |
| SUSE OpenStack Cloud 8 | openstack-nova | 16.1.5~dev49-3.8.4 |
| SUSE OpenStack Cloud 8 | openstack-nova-doc | 16.1.5~dev49-3.8.4 |
| SUSE OpenStack Cloud 8 | openstack-nova-virt-zvm | 8.0.1~dev56-3.3.4 |
| SUSE OpenStack Cloud 8 | openstack-octavia | 1.0.3~dev21-4.6.3 |
| SUSE OpenStack Cloud 8 | openstack-trove | 8.0.1~dev11-3.3.3 |
| SUSE OpenStack Cloud 8 | openstack-trove-doc | 8.0.1~dev11-3.3.3 |
| SUSE OpenStack Cloud 8 | python-barbicanclient | 4.5.2-4.3.2 |
| SUSE OpenStack Cloud 8 | python-keystone-json-assignment | 0.0.2-3.3.2 |
| SUSE OpenStack Cloud 8 | python-manilaclient | 1.17.3-3.3.2 |
| SUSE OpenStack Cloud 8 | python-vmware-nsx | 11.0.3~dev16-3.3.2 |
| SUSE OpenStack Cloud 8 | python-vmware-nsxlib | 11.0.4~dev7-3.3.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-aodh | 5.0.1-12.4.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-barbican | 5.0.1-12.5.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-cinder | 11.0.2-14.5.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-designate | 5.0.1-12.3.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-glance | 15.0.1-12.3.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-heat | 9.0.1-12.5.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-horizon | 11.0.2-14.6.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-ironic | 9.1.3-12.5.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-keystone | 12.0.1-11.5.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-magnum | 5.0.2-11.4.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-manila | 5.0.2-12.5.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-neutron | 11.0.2-13.8.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-nova | 16.0.3-11.6.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-octavia | 1.0.2-12.5.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-sahara | 7.0.1-11.4.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-trove | 8.0.0.0-11.4.1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-aodh | 5.1.1~dev5-3.5.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-aodh-doc | 5.1.1~dev5-3.5.4 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-barbican | 5.0.1~dev11-3.8.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-barbican-doc | 5.0.1~dev11-3.8.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-cinder | 11.1.2~dev14-3.6.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-cinder-doc | 11.1.2~dev14-3.6.4 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-dashboard | 12.0.4~dev1-3.8.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-designate | 5.0.2~dev5-3.5.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-designate-doc | 5.0.2~dev5-3.5.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-glance | 15.0.2~dev4-3.3.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-glance-doc | 15.0.2~dev4-3.3.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-heat | 9.0.5~dev11-3.6.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-heat-doc | 9.0.5~dev11-3.6.4 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-heat-templates | 0.0.0+git.1525957319.6b5a7cd-3.3.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-horizon-plugin-designate-ui | 5.0.2~dev5-3.3.5 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-horizon-plugin-freezer-ui | 5.0.1~dev6-3.3.5 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-horizon-plugin-gbp-ui | 5.0.1~dev21-4.3.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-horizon-plugin-manila-ui | 2.10.3~dev4-4.5.5 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-horizon-plugin-neutron-lbaas-ui | 3.0.3~dev2-3.5.4 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-horizon-plugin-trove-ui | 9.0.1~dev7-3.3.5 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-ironic | 9.1.5~dev7-3.6.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-ironic-doc | 9.1.5~dev7-3.6.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-keystone | 12.0.1~dev19-5.8.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-keystone-doc | 12.0.1~dev19-5.8.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-manila | 5.0.2~dev55-3.6.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-manila-doc | 5.0.2~dev55-3.6.4 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron | 11.0.6~dev63-3.6.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron-doc | 11.0.6~dev63-3.6.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron-fwaas | 11.0.2~dev7-3.5.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron-fwaas-doc | 11.0.2~dev7-3.5.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron-lbaas | 11.0.4~dev4-3.3.4 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron-lbaas-doc | 11.0.4~dev4-3.3.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron-vpnaas | 11.0.1~dev1-3.3.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron-vpnaas-doc | 11.0.1~dev1-3.3.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron-zvm-agent | 8.0.1~dev12-4.3.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-nova | 16.1.5~dev49-3.8.4 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-nova-doc | 16.1.5~dev49-3.8.4 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-nova-virt-zvm | 8.0.1~dev56-3.3.4 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-octavia | 1.0.3~dev21-4.6.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-trove | 8.0.1~dev11-3.3.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-trove-doc | 8.0.1~dev11-3.3.3 |
| SUSE OpenStack Cloud Crowbar 8 | python-barbicanclient | 4.5.2-4.3.2 |
| SUSE OpenStack Cloud Crowbar 8 | python-keystone-json-assignment | 0.0.2-3.3.2 |
| SUSE OpenStack Cloud Crowbar 8 | python-manilaclient | 1.17.3-3.3.2 |
| SUSE OpenStack Cloud Crowbar 8 | python-vmware-nsx | 11.0.3~dev16-3.3.2 |
| SUSE OpenStack Cloud Crowbar 8 | python-vmware-nsxlib | 11.0.4~dev7-3.3.2 |