NVD Vulnerability Detail

CVE-2019-19687

Summary	OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)
Publication Date	Dec. 10, 2019, 3:15 a.m.
Registration Date	Jan. 26, 2021, 11:41 a.m.
Last Update	Nov. 21, 2024, 1:35 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2019/12/11/8	Third Party Advisory
2	http://www.openwall.com/lists/oss-security/2019/12/11/8	Third Party Advisory
3	https://access.redhat.com/errata/RHSA-2019:4358
4	https://access.redhat.com/errata/RHSA-2019:4358
5	https://bugs.launchpad.net/keystone/+bug/1855080	Exploit Third Party Advisory
6	https://bugs.launchpad.net/keystone/+bug/1855080	Exploit Third Party Advisory
7	https://review.opendev.org/#/c/697355/	Patch Third Party Advisory
8	https://review.opendev.org/#/c/697355/	Patch Third Party Advisory
9	https://review.opendev.org/#/c/697611/	Patch Third Party Advisory
10	https://review.opendev.org/#/c/697611/	Patch Third Party Advisory
11	https://review.opendev.org/#/c/697731/	Patch Third Party Advisory
12	https://review.opendev.org/#/c/697731/	Patch Third Party Advisory
13	https://security.openstack.org/ossa/OSSA-2019-006.html	Vendor Advisory
14	https://security.openstack.org/ossa/OSSA-2019-006.html	Vendor Advisory
15	https://usn.ubuntu.com/4262-1/
16	https://usn.ubuntu.com/4262-1/

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-522	認証情報の不十分な保護	https://cwe.mitre.org/data/definitions/522.html

JVN Vulnerability Information

OpenStack Keystone におけるキャッシュからの情報漏えいに関する脆弱性

Title	OpenStack Keystone におけるキャッシュからの情報漏えいに関する脆弱性
Summary	OpenStack Keystone には、キャッシュからの情報漏えいに関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Dec. 9, 2019, midnight
Registration Date	Dec. 20, 2019, 11:15 a.m.
Last Update	Dec. 20, 2019, 11:15 a.m.

Affected System

OpenStack

Openstack Keystone 15.0.0

Openstack Keystone 16.0.0

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-19687	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19687
National Vulnerability Database (NVD)
2	CVE-2019-19687	https://nvd.nist.gov/vuln/detail/CVE-2019-19687

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-522	https://cwe.mitre.org/data/definitions/522.html

ベンダー情報

No	Name	URL
OpenStack
1	Change 697355 Fix credential list for project members	https://review.opendev.org/#/c/697355/
2	Change 697611 Fix credential list for project members	https://review.opendev.org/#/c/697611/
3	Change 697731 Fix credential list for project members	https://review.opendev.org/#/c/697731/
OpenStack Security Advisories
4	OSSA-2019-006: Credentials API allows listing and retrieving of all users credentials	https://security.openstack.org/ossa/OSSA-2019-006.html

Change Log

No	Changed Details	Date of change
1	[2019年12月20日] 掲載	Dec. 20, 2019, 11:15 a.m.