SB2018082312 - Red Hat update for keystone

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018082312

SB2018082312 - Red Hat update for keystone

Published: August 23, 2018

Security Bulletin ID SB2018082312
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Security restrictions bypass (CVE-ID: CVE-2018-14432)

The vulnerability allows a remote authenticated attacker to bypass security restrictions on the target system.

The vulnerability exists in the Federation component in Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json due to an error when handling malicious input. A remote attacker can submit authenticated "GET /v3/OS-FEDERATION/projects" request, bypass intended access restrictions on listing projects and discover projects he has no authority to access, leaking all projects in the deployment and their attributes. 


Remediation

Install update from vendor's website.

References