OpenStack Security Advisory

  1. Bug #1779205
  2. Comment #68

Comment 68 for bug 1779205

Revision history for this message
Abhishek Sharma M (abhi.sharma) wrote :

Description part in http://seclists.org/oss-sec/2018/q3/59 says that - "Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected". We are not using federation in our product & neither is there any mention of this api in our keystone's policy.json, but still we see that any user with a token is able to run GET /v3/OS-FEDERATION/projects & gets all projects in response.