exploitDog

ALT-PU-2018-3735

Низкий

ALT-PU-2018-3735: package openstack-keystone update to version 14.0.1-alt1

Источник

errata.altlinux.org

Дата публикации

20.12.2018

Дата обновления

20.12.2018

Устраненные уязвимости

1

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades openstack-keystone to version 14.0.1-alt1.

Устраненные уязвимости1

Ссылки1

ALT-PU-2018-3735 https://errata.altlinux.org/ALT-PU-2018-3735

Связанные уязвимости

CVE-2018-14432

CVSS3: 5.3

ubuntu

больше 8 лет назад

In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.

CVE-2018-14432

CVSS3: 5.3

redhat

больше 8 лет назад

In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.

CVE-2018-14432

CVSS3: 5.3

nvd

больше 8 лет назад

In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.

CVE-2018-14432

CVSS3: 5.3

debian

больше 8 лет назад

In the Federation component of OpenStack Keystone before 11.0.4, 12.0. ...

GHSA-v25x-mmfh-g7w6

CVSS3: 5.3

github

больше 4 лет назад

In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.