OSSA-2017-004: Incorrect role assignment with federated Keystone¶
- Date:
April 25, 2017
- CVE:
CVE-2017-2673
Affects¶
Keystone: >=10.0.0 <=10.0.1, ==11.0.0
Description¶
Boris Bobrov from Mail.Ru reported a vulnerability in Keystone Federation. An authenticated user may receive all the roles assigned to the user’s project regardless of the federation mapping when there are rules in which group-based assignments are not used. For example, by requesting an admin user to get a role in their project, the user may be granted the admin privileges for new scoped tokens. All setups using the Keystone federation without group based assignments rules are affected.
Patches¶
Credits¶
Boris Bobrov from Mail.Ru (CVE-2017-2673)
