Incorrect role assignment with federated Keystone (CVE-2017-2673) (OSSA-2017-004)

[Dmitry Mescheryakov]

Title: Incorrect role assignment with federated Keystone
Reporter: Boris Bobrov (Mail.Ru)
Products: Keystone
Affects: ==11.0.0

Description:
Boris Bobrov from Mail.Ru reported a vulnerability in Keystone
Federation. An authenticated user may receive all the roles assigned to
the user's project regardless of the federation mapping when there are
rules in which group-based assignments are not used. For example, by
requesting an admin user to get a role in their project, the user may be
granted the admin privileges for new scoped tokens. All setups using the
Keystone federation with projects auto-provisioning and no group based
assignments rules are affected.

Proposed patch:
See attached patches. Unless a flaw is discovered in them, these patches
will be merged to their corresponding branches on the public disclosure date.

CVE: CVE-2017-2673

Proposed public disclosure date/time:
2017-04-12, 1500UTC
Please do not make the issue public (or release public patches) before
this coordinated embargo date.

[Denis Meltsaykin (dmeltsaykin)]

It doesn't seem like we have an appropriate milestone for it, feel free to retarget.

[Adam Heczko (aheczko-mirantis)]

Patches:
https://review.openstack.org/459713 (Newton)
https://review.openstack.org/459732 (Ocata)
https://review.openstack.org/459705 (Pike)

References:
https://launchpad.net/bugs/1677723
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2673

[Adam Heczko (aheczko-mirantis)]

After code review it became apparent that Mitaka is also vulnerable and most likely Liberty also.
Please backport fix for Mitaka and Liberty.

[Denis Meltsaykin (dmeltsaykin)]

Fix for 9.2: https://review.fuel-infra.org/#/c/35137/

[Ilya Bumarskov (ibumarskov)]

Verified (code only) on Fuel 9.2 MU2 (MOS_UBUNTU_ID=9.0-2017-06-20-142429)

[Denis Meltsaykin (dmeltsaykin)]

According to https://bugs.launchpad.net/keystone/+bug/1677723/comments/9 versions prior to Mitaka are not affected, closing as Invalid for 7.0 and 8.0

[Adam Heczko (aheczko-mirantis)]

Invalid for Kilo is OK for me, however Denis please provide more detailed explanation with some code examples why this is invalid. It was requested by one of our customers who would like to understand why Kilo is not affected.