================================================================ OSSA-2017-004: Incorrect role assignment with federated Keystone ================================================================

:Date: April 25, 2017 :CVE: CVE-2017-2673

Affects ~~~~~~~ - Keystone: >=10.0.0 <=10.0.1, ==11.0.0

Description ~~~~~~~~~~~ Boris Bobrov from Mail.Ru reported a vulnerability in Keystone Federation. An authenticated user may receive all the roles assigned to the user's project regardless of the federation mapping when there are rules in which group-based assignments are not used. For example, by requesting an admin user to get a role in their project, the user may be granted the admin privileges for new scoped tokens. All setups using the Keystone federation without group based assignments rules are affected.

Patches ~~~~~~~ - https://review.openstack.org/459713 (Newton) - https://review.openstack.org/459732 (Ocata) - https://review.openstack.org/459705 (Pike)

Credits ~~~~~~~ - Boris Bobrov from Mail.Ru (CVE-2017-2673)

References ~~~~~~~~~~ - https://launchpad.net/bugs/1677723 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2673

-- Tristan Cacqueray OpenStack Vulnerability Management Team