Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

RedHat OpenStack Platform 15: RHSA-2020-3102-01 Important Security Update

red hat
Calendar Grey July 22, 2020
Dist Redhat Esm H88
A significant security notice has emerged for openstack-keystone, impacting Red Hat OpenStack Platform version 15. Comprehensive remedial measures are outlined to address this issue.
An update for openstack-keystone is now available for Red Hat OpenStack Platform 15 (Stein)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

The OpenStack Identity service (keystone) authenticates and authorizes OpenStack users by keeping track of users and their permitted activities. The Identity service supports multiple forms of authentication, including user name and password credentials, token-based systems, and AWS-style logins.
Security Fix(es):
* EC2 and credential endpoints are not protected from a scoped context (CVE-2020-12689)
* OAuth1 request token authorize silently ignores roles parameter (CVE-2020-12690)
* Credentials endpoint policy logic allows changing credential owner and target project ID (CVE-2020-12691)
* failure to check signature TTL of the EC2 credential auth method (CVE-2020-12692)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.

Topics%20covered

Topics Covered

security advisory red hat threat important authentication credential issue openstack-keystone

References

https://access.redhat.com/security/cve/CVE-2020-12689 https://access.redhat.com/security/cve/CVE-2020-12690 https://access.redhat.com/security/cve/CVE-2020-12691 https://access.redhat.com/security/cve/CVE-2020-12692 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat OpenStack Platform 15.0:
Source: openstack-keystone-15.0.1-0.20200512110437.95b2bbe.el8ost.src.rpm
noarch: openstack-keystone-15.0.1-0.20200512110437.95b2bbe.el8ost.noarch.rpm python3-keystone-15.0.1-0.20200512110437.95b2bbe.el8ost.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2020:3102-01
Product: Red Hat OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2020:3102
Issue date: 2020-07-22

Topic

An update for openstack-keystone is now available for Red Hat OpenStackPlatform 15 (Stein).Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory red hat threat important authentication credential issue openstack-keystone

Relevant Releases Architectures

Red Hat OpenStack Platform 15.0 - noarch

Bugs Fixed

1830384 - CVE-2020-12691 openstack-keystone: Credentials endpoint policy logic allows changing credential owner and target project ID

1830395 - CVE-2020-12690 openstack-keystone: OAuth1 request token authorize silently ignores roles parameter

1830396 - CVE-2020-12689 openstack-keystone: EC2 and credential endpoints are not protected from a scoped context

1833164 - CVE-2020-12692 openstack-keystone: failure to check signature TTL of the EC2 credential auth method

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here