CVE-2020-12690

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 15.0.1 OpenStack Keystone version 16.0.0

Description An issue in OpenStack Keystone causes the list of roles provided for an OAuth1 access token to be silently ignored. When an access token is used to request a keystone token, the resulting keystone token contains every role assignment the creator had for the project, potentially leading to unintended escalated access.

Recommendations For OpenStack Keystone versions prior to 15.0.1, update to version 15.0.1 or later to resolve the issue. For OpenStack Keystone version 16.0.0, consider disabling the use of OAuth1 access tokens until a patch is available.