CVE-2019-19687

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)"}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-01-31T13:06:07.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://bugs.launchpad.net/keystone/+bug/1855080"}, {"tags": ["x_refsource_MISC"], "url": "https://review.opendev.org/#/c/697355/"}, {"tags": ["x_refsource_MISC"], "url": "https://review.opendev.org/#/c/697611/"}, {"tags": ["x_refsource_MISC"], "url": "https://review.opendev.org/#/c/697731/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://security.openstack.org/ossa/OSSA-2019-006.html"}, {"name": "[oss-security] 20191211 [OSSA-2019-006] Keystone: Credentials API allows listing and retrieving of all users credentials (CVE-2019-19687)", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2019/12/11/8"}, {"name": "RHSA-2019:4358", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:4358"}, {"name": "USN-4262-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/4262-1/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-19687", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://bugs.launchpad.net/keystone/+bug/1855080", "refsource": "MISC", "url": "https://bugs.launchpad.net/keystone/+bug/1855080"}, {"name": "https://review.opendev.org/#/c/697355/", "refsource": "MISC", "url": "https://review.opendev.org/#/c/697355/"}, {"name": "https://review.opendev.org/#/c/697611/", "refsource": "MISC", "url": "https://review.opendev.org/#/c/697611/"}, {"name": "https://review.opendev.org/#/c/697731/", "refsource": "MISC", "url": "https://review.opendev.org/#/c/697731/"}, {"name": "https://security.openstack.org/ossa/OSSA-2019-006.html", "refsource": "CONFIRM", "url": "https://security.openstack.org/ossa/OSSA-2019-006.html"}, {"name": "[oss-security] 20191211 [OSSA-2019-006] Keystone: Credentials API allows listing and retrieving of all users credentials (CVE-2019-19687)", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2019/12/11/8"}, {"name": "RHSA-2019:4358", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:4358"}, {"name": "USN-4262-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4262-1/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T02:25:12.373Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugs.launchpad.net/keystone/+bug/1855080"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://review.opendev.org/#/c/697355/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://review.opendev.org/#/c/697611/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://review.opendev.org/#/c/697731/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://security.openstack.org/ossa/OSSA-2019-006.html"}, {"name": "[oss-security] 20191211 [OSSA-2019-006] Keystone: Credentials API allows listing and retrieving of all users credentials (CVE-2019-19687)", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2019/12/11/8"}, {"name": "RHSA-2019:4358", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:4358"}, {"name": "USN-4262-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/4262-1/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-19687", "datePublished": "2019-12-09T17:14:14.000Z", "dateReserved": "2019-12-09T00:00:00.000Z", "dateUpdated": "2024-08-05T02:25:12.373Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openstack:keystone:15.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "9FD05D79-A4D5-46A7-9F88-DF945A2B26A1", "vulnerable": true}, {"criteria": "cpe:2.3:a:openstack:keystone:16.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "71945B91-B12D-4EF4-AE03-91592D434125", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)"}, {"lang": "es", "value": "OpenStack Keystone versiones 15.0.0 y 16.0.0, est\u00e1 afectado por un Filtrado de Datos en la API de credenciales de lista. Cualquier usuario con un rol en un proyecto es capaz de enumerar cualquier credencial con la API de /v3/credentials cuando la funci\u00f3n enforce_scope es falsa. Los usuarios con un rol en un proyecto pueden visualizar las credenciales de cualquier otro usuario, lo que podr\u00eda (por ejemplo) filtrar informaci\u00f3n de inicio de sesi\u00f3n de Time-based One Time Passwords (TOTP). Las implementaciones con la funci\u00f3n enforce_scope establecida en false est\u00e1n afectadas. (Habr\u00e1 un ligero impacto en el rendimiento de la API de credenciales de lista una vez que este problema sea corregido)."}], "id": "CVE-2019-19687", "lastModified": "2026-06-17T02:27:03.407", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-12-09T18:15:09.827", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2019/12/11/8"}, {"source": "cve@mitre.org", "url": "https://access.redhat.com/errata/RHSA-2019:4358"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://bugs.launchpad.net/keystone/+bug/1855080"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://review.opendev.org/#/c/697355/"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://review.opendev.org/#/c/697611/"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://review.opendev.org/#/c/697731/"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://security.openstack.org/ossa/OSSA-2019-006.html"}, {"source": "cve@mitre.org", "url": "https://usn.ubuntu.com/4262-1/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2019/12/11/8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2019:4358"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://bugs.launchpad.net/keystone/+bug/1855080"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://review.opendev.org/#/c/697355/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://review.opendev.org/#/c/697611/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://review.opendev.org/#/c/697731/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://security.openstack.org/ossa/OSSA-2019-006.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://usn.ubuntu.com/4262-1/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2019:4358", "cpe": "cpe:/a:redhat:openstack:15::el8", "package": "openstack-keystone-1:15.0.1-0.20190720060412.5f27c4b.1.el8ost", "product_name": "Red Hat OpenStack Platform 15.0 (Stein)", "release_date": "2019-12-19T00:00:00Z"}, {"advisory": "RHEA-2020:0283", "cpe": "cpe:/a:redhat:openstack:16::el8", "package": "openstack-keystone-1:16.0.1-0.20191210095025.bd3f637.el8ost", "product_name": "Red Hat OpenStack Platform 16.0 (Train)", "release_date": "2020-02-06T00:00:00Z"}], "bugzilla": {"description": "openstack-keystone: Credentials API allows non-admin to list and retrieve all users credentials", "id": "1781470", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1781470"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "status": "verified"}, "cwe": "CWE-522", "details": ["OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)", "A disclosure vulnerability was found in openstack-keystone's credentials API. Users with a project role are able to list any credentials with the /v3/credentials API when enforce_scope is false. Information for time-based one time passwords (TOTP) may also be disclosed. Deployments running keystone with enforce_scope set to false are also affected. There will be a slight performance impact for the list credentials API once this issue is fixed."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, set the [oslo_policy] enforce_scope option to 'true' in the keystone.conf file."}, "name": "CVE-2019-19687", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:6", "fix_state": "Not affected", "package_name": "jclouds_openstack-keystone_api", "product_name": "Red Hat JBoss Fuse 6"}], "public_date": "2019-12-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2019-19687\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-19687\nhttps://seclists.org/oss-sec/2019/q4/152\nhttps://security.openstack.org/ossa/OSSA-2019-006.html"], "threat_severity": "Important"}

{}