CVE-2017-2673

An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
redhatCNA
6.8 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVEADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 79%
Debian logo
Debian Releases
Debian Product
Codename
keystone
bullseye
2:18.0.0-3+deb11u1
fixed
jessie
not-affected
wheezy
not-affected
bookworm
2:22.0.0-2
fixed
sid
2:26.0.0-1
fixed
trixie
2:26.0.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
keystone
zesty
not-affected
yakkety
ignored
xenial
Fixed 2:9.3.0-0ubuntu3.1
released
trusty
dne
precise
ignored
Common Weakness Enumeration
References
http://seclists.org/oss-sec/2017/q2/125
http://www.securityfocus.com/bid/98032
https://access.redhat.com/errata/RHSA-2017:1461
https://access.redhat.com/errata/RHSA-2017:1597
https://bugs.launchpad.net/keystone/+bug/1677723
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2673
http://seclists.org/oss-sec/2017/q2/125
http://www.securityfocus.com/bid/98032
https://access.redhat.com/errata/RHSA-2017:1461
https://access.redhat.com/errata/RHSA-2017:1597
https://bugs.launchpad.net/keystone/+bug/1677723
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2673