| 2019-12-04 10:14:12 |
Daniel 'f0o' Preussker |
bug |
|
|
added bug |
| 2019-12-04 10:15:52 |
Daniel 'f0o' Preussker |
bug task added |
|
keystone (Ubuntu) |
|
| 2019-12-04 14:29:05 |
Jeremy Stanley |
description |
Tested against Stein and Train.
# User creating a credential, i.e totp or similar
$ OS_CLOUD=1 openstack token issue
| project_id | c3caf1b55bb84b78a795fd81838e5160
| user_id | 9971b0f13d2d4a578212d028a53c3209
$ OS_CLOUD=1 openstack credential create --type test 9971b0f13d2d4a578212d028a53c3209 test-data
$ OS_CLOUD=1 openstack credential list
+----------------------------------+------+----------------------------------+-----------+------------+
| ID | Type | User ID | Data | Project ID |
+----------------------------------+------+----------------------------------+-----------+------------+
| 0a3a2d3b7dad4886b0bbf61b6cd7d2b0 | test | 9971b0f13d2d4a578212d028a53c3209 | test-data | None |
+----------------------------------+------+----------------------------------+-----------+------------+
# Different User but same Project
$ OS_CLOUD=2 openstack token issue
| project_id | c3caf1b55bb84b78a795fd81838e5160
| user_id | 6b28a0b073fc4ac7843f33190ebc5c3c
$ OS_CLOUD=2 openstack credential list
+----------------------------------+------+----------------------------------+-----------+------------+
| ID | Type | User ID | Data | Project ID |
+----------------------------------+------+----------------------------------+-----------+------------+
| 0a3a2d3b7dad4886b0bbf61b6cd7d2b0 | test | 9971b0f13d2d4a578212d028a53c3209 | test-data | None |
+----------------------------------+------+----------------------------------+-----------+------------+
# Different User and Different Project
$ OS_CLOUD=3 openstack token issue
| project_id | d43f20ae5a7e4f36b701710277384401
| user_id | 2e48f1a7d1474391a826a2b9700e5949
$ OS_CLOUD=3 openstack credential list
+----------------------------------+------+----------------------------------+-----------+------------+
| ID | Type | User ID | Data | Project ID |
+----------------------------------+------+----------------------------------+-----------+------------+
| 0a3a2d3b7dad4886b0bbf61b6cd7d2b0 | test | 9971b0f13d2d4a578212d028a53c3209 | test-data | None |
+----------------------------------+------+----------------------------------+-----------+------------+
As shown anyone who's authenticated can retrieve any credentials including their 'secret'.
This is a rather severe information disclosure vulnerability and completely defies the purpose of TOTP or MFA as these credentials are not kept secure or private whatsoever.
If Auth-rules are configured allow login with only 'topt' it would be extremely easy to assume a different user's identity.
A CVE should be issued for this. I can take care of that paperwork.
Versions affected and tested:
Train/ubuntu:
$ dpkg -l | grep keystone
ii keystone 2:16.0.0-0ubuntu1~cloud0 all OpenStack identity service - Daemons
ii keystone-common 2:16.0.0-0ubuntu1~cloud0 all OpenStack identity service - Common files
ii python-keystoneauth1 3.13.1-0ubuntu1~cloud0 all authentication library for OpenStack Identity - Python 2.7
ii python-keystoneclient 1:3.19.0-0ubuntu1~cloud0 all client library for the OpenStack Keystone API - Python 2.x
ii python-keystonemiddleware 6.0.0-0ubuntu1~cloud0 all Middleware for OpenStack Identity (Keystone) - Python 2.x
ii python3-keystone 2:16.0.0-0ubuntu1~cloud0 all OpenStack identity service - Python 3 library
ii python3-keystoneauth1 3.17.1-0ubuntu1~cloud0 all authentication library for OpenStack Identity - Python 3.x
ii python3-keystoneclient 1:3.21.0-0ubuntu1~cloud0 all client library for the OpenStack Keystone API - Python 3.x
ii python3-keystonemiddleware 7.0.1-0ubuntu1~cloud0 all Middleware for OpenStack Identity (Keystone) - Python 3.x
Stein/RHEL:
$ rpm -qa | grep keystone
python3-keystoneclient-3.19.0-0.20190312070330.6c4bb8b.el8ost.noarch
openstack-keystone-15.0.1-0.20190720060412.5f27c4b.el8ost.noarch
python3-keystoneauth1-3.13.1-0.20190311052414.bde07bc.el8ost.noarch
python3-keystonemiddleware-6.0.0-0.20190312071144.fca37ea.el8ost.noarch
python3-keystone-15.0.1-0.20190720060412.5f27c4b.el8ost.noarch |
This issue is being treated as a potential security risk under embargo. Please do not make any public mention of embargoed (private) security vulnerabilities before their coordinated publication by the OpenStack Vulnerability Management Team in the form of an official OpenStack Security Advisory. This includes discussion of the bug or associated fixes in public forums such as mailing lists, code review systems and bug trackers. Please also avoid private disclosure to other individuals not already approved for access to this information, and provide this same reminder to those who are made aware of the issue prior to publication. All discussion should remain confined to this private bug report, and any proposed fixes should be added to the bug as attachments.
Tested against Stein and Train.
# User creating a credential, i.e totp or similar
$ OS_CLOUD=1 openstack token issue
| project_id | c3caf1b55bb84b78a795fd81838e5160
| user_id | 9971b0f13d2d4a578212d028a53c3209
$ OS_CLOUD=1 openstack credential create --type test 9971b0f13d2d4a578212d028a53c3209 test-data
$ OS_CLOUD=1 openstack credential list
+----------------------------------+------+----------------------------------+-----------+------------+
| ID | Type | User ID | Data | Project ID |
+----------------------------------+------+----------------------------------+-----------+------------+
| 0a3a2d3b7dad4886b0bbf61b6cd7d2b0 | test | 9971b0f13d2d4a578212d028a53c3209 | test-data | None |
+----------------------------------+------+----------------------------------+-----------+------------+
# Different User but same Project
$ OS_CLOUD=2 openstack token issue
| project_id | c3caf1b55bb84b78a795fd81838e5160
| user_id | 6b28a0b073fc4ac7843f33190ebc5c3c
$ OS_CLOUD=2 openstack credential list
+----------------------------------+------+----------------------------------+-----------+------------+
| ID | Type | User ID | Data | Project ID |
+----------------------------------+------+----------------------------------+-----------+------------+
| 0a3a2d3b7dad4886b0bbf61b6cd7d2b0 | test | 9971b0f13d2d4a578212d028a53c3209 | test-data | None |
+----------------------------------+------+----------------------------------+-----------+------------+
# Different User and Different Project
$ OS_CLOUD=3 openstack token issue
| project_id | d43f20ae5a7e4f36b701710277384401
| user_id | 2e48f1a7d1474391a826a2b9700e5949
$ OS_CLOUD=3 openstack credential list
+----------------------------------+------+----------------------------------+-----------+------------+
| ID | Type | User ID | Data | Project ID |
+----------------------------------+------+----------------------------------+-----------+------------+
| 0a3a2d3b7dad4886b0bbf61b6cd7d2b0 | test | 9971b0f13d2d4a578212d028a53c3209 | test-data | None |
+----------------------------------+------+----------------------------------+-----------+------------+
As shown anyone who's authenticated can retrieve any credentials including their 'secret'.
This is a rather severe information disclosure vulnerability and completely defies the purpose of TOTP or MFA as these credentials are not kept secure or private whatsoever.
If Auth-rules are configured allow login with only 'topt' it would be extremely easy to assume a different user's identity.
A CVE should be issued for this. I can take care of that paperwork.
Versions affected and tested:
Train/ubuntu:
$ dpkg -l | grep keystone
ii keystone 2:16.0.0-0ubuntu1~cloud0 all OpenStack identity service - Daemons
ii keystone-common 2:16.0.0-0ubuntu1~cloud0 all OpenStack identity service - Common files
ii python-keystoneauth1 3.13.1-0ubuntu1~cloud0 all authentication library for OpenStack Identity - Python 2.7
ii python-keystoneclient 1:3.19.0-0ubuntu1~cloud0 all client library for the OpenStack Keystone API - Python 2.x
ii python-keystonemiddleware 6.0.0-0ubuntu1~cloud0 all Middleware for OpenStack Identity (Keystone) - Python 2.x
ii python3-keystone 2:16.0.0-0ubuntu1~cloud0 all OpenStack identity service - Python 3 library
ii python3-keystoneauth1 3.17.1-0ubuntu1~cloud0 all authentication library for OpenStack Identity - Python 3.x
ii python3-keystoneclient 1:3.21.0-0ubuntu1~cloud0 all client library for the OpenStack Keystone API - Python 3.x
ii python3-keystonemiddleware 7.0.1-0ubuntu1~cloud0 all Middleware for OpenStack Identity (Keystone) - Python 3.x
Stein/RHEL:
$ rpm -qa | grep keystone
python3-keystoneclient-3.19.0-0.20190312070330.6c4bb8b.el8ost.noarch
openstack-keystone-15.0.1-0.20190720060412.5f27c4b.el8ost.noarch
python3-keystoneauth1-3.13.1-0.20190311052414.bde07bc.el8ost.noarch
python3-keystonemiddleware-6.0.0-0.20190312071144.fca37ea.el8ost.noarch
python3-keystone-15.0.1-0.20190720060412.5f27c4b.el8ost.noarch |
|
| 2019-12-04 14:29:17 |
Jeremy Stanley |
bug task added |
|
ossa |
|
| 2019-12-04 14:29:25 |
Jeremy Stanley |
ossa: status |
New |
Incomplete |
|
| 2019-12-04 14:29:54 |
Jeremy Stanley |
bug |
|
|
added subscriber Keystone Core security contacts |
| 2019-12-04 17:53:54 |
Colleen Murphy |
keystone: status |
New |
Confirmed |
|
| 2019-12-04 17:53:58 |
Colleen Murphy |
keystone: importance |
Undecided |
Critical |
|
| 2019-12-04 18:11:54 |
Colleen Murphy |
attachment added |
|
1855080.patch https://bugs.launchpad.net/keystone/+bug/1855080/+attachment/5309809/+files/1855080.patch |
|
| 2019-12-04 18:57:11 |
Colleen Murphy |
attachment added |
|
0001-Fix-credential-list-for-project-members.patch https://bugs.launchpad.net/keystone/+bug/1855080/+attachment/5309814/+files/0001-Fix-credential-list-for-project-members.patch |
|
| 2019-12-04 19:42:10 |
Gage Hugo |
information type |
Private Security |
Public Security |
|
| 2019-12-04 19:45:28 |
OpenStack Infra |
keystone: status |
Confirmed |
In Progress |
|
| 2019-12-04 19:45:28 |
OpenStack Infra |
keystone: assignee |
|
Colleen Murphy (krinkle) |
|
| 2019-12-04 19:47:29 |
Jeremy Stanley |
description |
This issue is being treated as a potential security risk under embargo. Please do not make any public mention of embargoed (private) security vulnerabilities before their coordinated publication by the OpenStack Vulnerability Management Team in the form of an official OpenStack Security Advisory. This includes discussion of the bug or associated fixes in public forums such as mailing lists, code review systems and bug trackers. Please also avoid private disclosure to other individuals not already approved for access to this information, and provide this same reminder to those who are made aware of the issue prior to publication. All discussion should remain confined to this private bug report, and any proposed fixes should be added to the bug as attachments.
Tested against Stein and Train.
# User creating a credential, i.e totp or similar
$ OS_CLOUD=1 openstack token issue
| project_id | c3caf1b55bb84b78a795fd81838e5160
| user_id | 9971b0f13d2d4a578212d028a53c3209
$ OS_CLOUD=1 openstack credential create --type test 9971b0f13d2d4a578212d028a53c3209 test-data
$ OS_CLOUD=1 openstack credential list
+----------------------------------+------+----------------------------------+-----------+------------+
| ID | Type | User ID | Data | Project ID |
+----------------------------------+------+----------------------------------+-----------+------------+
| 0a3a2d3b7dad4886b0bbf61b6cd7d2b0 | test | 9971b0f13d2d4a578212d028a53c3209 | test-data | None |
+----------------------------------+------+----------------------------------+-----------+------------+
# Different User but same Project
$ OS_CLOUD=2 openstack token issue
| project_id | c3caf1b55bb84b78a795fd81838e5160
| user_id | 6b28a0b073fc4ac7843f33190ebc5c3c
$ OS_CLOUD=2 openstack credential list
+----------------------------------+------+----------------------------------+-----------+------------+
| ID | Type | User ID | Data | Project ID |
+----------------------------------+------+----------------------------------+-----------+------------+
| 0a3a2d3b7dad4886b0bbf61b6cd7d2b0 | test | 9971b0f13d2d4a578212d028a53c3209 | test-data | None |
+----------------------------------+------+----------------------------------+-----------+------------+
# Different User and Different Project
$ OS_CLOUD=3 openstack token issue
| project_id | d43f20ae5a7e4f36b701710277384401
| user_id | 2e48f1a7d1474391a826a2b9700e5949
$ OS_CLOUD=3 openstack credential list
+----------------------------------+------+----------------------------------+-----------+------------+
| ID | Type | User ID | Data | Project ID |
+----------------------------------+------+----------------------------------+-----------+------------+
| 0a3a2d3b7dad4886b0bbf61b6cd7d2b0 | test | 9971b0f13d2d4a578212d028a53c3209 | test-data | None |
+----------------------------------+------+----------------------------------+-----------+------------+
As shown anyone who's authenticated can retrieve any credentials including their 'secret'.
This is a rather severe information disclosure vulnerability and completely defies the purpose of TOTP or MFA as these credentials are not kept secure or private whatsoever.
If Auth-rules are configured allow login with only 'topt' it would be extremely easy to assume a different user's identity.
A CVE should be issued for this. I can take care of that paperwork.
Versions affected and tested:
Train/ubuntu:
$ dpkg -l | grep keystone
ii keystone 2:16.0.0-0ubuntu1~cloud0 all OpenStack identity service - Daemons
ii keystone-common 2:16.0.0-0ubuntu1~cloud0 all OpenStack identity service - Common files
ii python-keystoneauth1 3.13.1-0ubuntu1~cloud0 all authentication library for OpenStack Identity - Python 2.7
ii python-keystoneclient 1:3.19.0-0ubuntu1~cloud0 all client library for the OpenStack Keystone API - Python 2.x
ii python-keystonemiddleware 6.0.0-0ubuntu1~cloud0 all Middleware for OpenStack Identity (Keystone) - Python 2.x
ii python3-keystone 2:16.0.0-0ubuntu1~cloud0 all OpenStack identity service - Python 3 library
ii python3-keystoneauth1 3.17.1-0ubuntu1~cloud0 all authentication library for OpenStack Identity - Python 3.x
ii python3-keystoneclient 1:3.21.0-0ubuntu1~cloud0 all client library for the OpenStack Keystone API - Python 3.x
ii python3-keystonemiddleware 7.0.1-0ubuntu1~cloud0 all Middleware for OpenStack Identity (Keystone) - Python 3.x
Stein/RHEL:
$ rpm -qa | grep keystone
python3-keystoneclient-3.19.0-0.20190312070330.6c4bb8b.el8ost.noarch
openstack-keystone-15.0.1-0.20190720060412.5f27c4b.el8ost.noarch
python3-keystoneauth1-3.13.1-0.20190311052414.bde07bc.el8ost.noarch
python3-keystonemiddleware-6.0.0-0.20190312071144.fca37ea.el8ost.noarch
python3-keystone-15.0.1-0.20190720060412.5f27c4b.el8ost.noarch |
Tested against Stein and Train.
# User creating a credential, i.e totp or similar
$ OS_CLOUD=1 openstack token issue
| project_id | c3caf1b55bb84b78a795fd81838e5160
| user_id | 9971b0f13d2d4a578212d028a53c3209
$ OS_CLOUD=1 openstack credential create --type test 9971b0f13d2d4a578212d028a53c3209 test-data
$ OS_CLOUD=1 openstack credential list
+----------------------------------+------+----------------------------------+-----------+------------+
| ID | Type | User ID | Data | Project ID |
+----------------------------------+------+----------------------------------+-----------+------------+
| 0a3a2d3b7dad4886b0bbf61b6cd7d2b0 | test | 9971b0f13d2d4a578212d028a53c3209 | test-data | None |
+----------------------------------+------+----------------------------------+-----------+------------+
# Different User but same Project
$ OS_CLOUD=2 openstack token issue
| project_id | c3caf1b55bb84b78a795fd81838e5160
| user_id | 6b28a0b073fc4ac7843f33190ebc5c3c
$ OS_CLOUD=2 openstack credential list
+----------------------------------+------+----------------------------------+-----------+------------+
| ID | Type | User ID | Data | Project ID |
+----------------------------------+------+----------------------------------+-----------+------------+
| 0a3a2d3b7dad4886b0bbf61b6cd7d2b0 | test | 9971b0f13d2d4a578212d028a53c3209 | test-data | None |
+----------------------------------+------+----------------------------------+-----------+------------+
# Different User and Different Project
$ OS_CLOUD=3 openstack token issue
| project_id | d43f20ae5a7e4f36b701710277384401
| user_id | 2e48f1a7d1474391a826a2b9700e5949
$ OS_CLOUD=3 openstack credential list
+----------------------------------+------+----------------------------------+-----------+------------+
| ID | Type | User ID | Data | Project ID |
+----------------------------------+------+----------------------------------+-----------+------------+
| 0a3a2d3b7dad4886b0bbf61b6cd7d2b0 | test | 9971b0f13d2d4a578212d028a53c3209 | test-data | None |
+----------------------------------+------+----------------------------------+-----------+------------+
As shown anyone who's authenticated can retrieve any credentials including their 'secret'.
This is a rather severe information disclosure vulnerability and completely defies the purpose of TOTP or MFA as these credentials are not kept secure or private whatsoever.
If Auth-rules are configured allow login with only 'topt' it would be extremely easy to assume a different user's identity.
A CVE should be issued for this. I can take care of that paperwork.
Versions affected and tested:
Train/ubuntu:
$ dpkg -l | grep keystone
ii keystone 2:16.0.0-0ubuntu1~cloud0 all OpenStack identity service - Daemons
ii keystone-common 2:16.0.0-0ubuntu1~cloud0 all OpenStack identity service - Common files
ii python-keystoneauth1 3.13.1-0ubuntu1~cloud0 all authentication library for OpenStack Identity - Python 2.7
ii python-keystoneclient 1:3.19.0-0ubuntu1~cloud0 all client library for the OpenStack Keystone API - Python 2.x
ii python-keystonemiddleware 6.0.0-0ubuntu1~cloud0 all Middleware for OpenStack Identity (Keystone) - Python 2.x
ii python3-keystone 2:16.0.0-0ubuntu1~cloud0 all OpenStack identity service - Python 3 library
ii python3-keystoneauth1 3.17.1-0ubuntu1~cloud0 all authentication library for OpenStack Identity - Python 3.x
ii python3-keystoneclient 1:3.21.0-0ubuntu1~cloud0 all client library for the OpenStack Keystone API - Python 3.x
ii python3-keystonemiddleware 7.0.1-0ubuntu1~cloud0 all Middleware for OpenStack Identity (Keystone) - Python 3.x
Stein/RHEL:
$ rpm -qa | grep keystone
python3-keystoneclient-3.19.0-0.20190312070330.6c4bb8b.el8ost.noarch
openstack-keystone-15.0.1-0.20190720060412.5f27c4b.el8ost.noarch
python3-keystoneauth1-3.13.1-0.20190311052414.bde07bc.el8ost.noarch
python3-keystonemiddleware-6.0.0-0.20190312071144.fca37ea.el8ost.noarch
python3-keystone-15.0.1-0.20190720060412.5f27c4b.el8ost.noarch |
|
| 2019-12-04 19:47:46 |
Jeremy Stanley |
ossa: status |
Incomplete |
Confirmed |
|
| 2019-12-04 19:49:06 |
Jeremy Stanley |
ossa: importance |
Undecided |
High |
|
| 2019-12-04 19:49:20 |
Jeremy Stanley |
ossa: assignee |
|
Gage Hugo (gagehugo) |
|
| 2019-12-04 20:25:17 |
Ubuntu Foundations Team Bug Bot |
tags |
|
patch |
|
| 2019-12-04 20:25:24 |
Ubuntu Foundations Team Bug Bot |
bug |
|
|
added subscriber Ubuntu Review Team |
| 2019-12-05 19:05:55 |
Gage Hugo |
summary |
Credentials API allows listing and retrieving of all user's credentials |
Credentials API allows listing and retrieving of all users' credentials |
|
| 2019-12-05 19:49:07 |
Gage Hugo |
summary |
Credentials API allows listing and retrieving of all users' credentials |
Credentials API allows listing and retrieving of all users credentials |
|
| 2019-12-06 02:20:25 |
OpenStack Infra |
keystone: status |
In Progress |
Fix Released |
|
| 2019-12-06 22:06:28 |
OpenStack Infra |
tags |
patch |
in-stable-train patch |
|
| 2019-12-07 20:20:29 |
OpenStack Infra |
tags |
in-stable-train patch |
in-stable-stein in-stable-train patch |
|
| 2019-12-12 03:40:53 |
Summer Long |
bug |
|
|
added subscriber Summer Long |
| 2020-01-02 20:11:08 |
Gage Hugo |
ossa: status |
Confirmed |
Fix Released |
|
| 2020-05-22 04:42:44 |
Alex Murray |
cve linked |
|
2019-19687 |
|
| 2020-05-22 04:42:51 |
Alex Murray |
keystone (Ubuntu): status |
New |
Fix Released |
|
| 2020-05-22 15:34:39 |
Jeremy Stanley |
summary |
Credentials API allows listing and retrieving of all users credentials |
[OSSA-2019-006] Credentials API allows listing and retrieving of all users credentials (CVE-2019-19687) |
|
