Search for packages
| purl | pkg:rpm/redhat/openstack-keystone@1:15.0.1-0.20190720060412.5f27c4b.1?arch=el8ost |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-gdk6-a746-6fac
Aliases: CVE-2019-19687 GHSA-2j23-fwqm-mgwr PYSEC-2019-29 |
OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.) | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T14:14:56.901283+00:00 | RedHat Importer | Affected by | VCID-gdk6-a746-6fac | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-19687.json | 38.0.0 |