{"url":"http://public2.vulnerablecode.io/api/packages/14684?format=json","purl":"pkg:pypi/keystone@16.0.0.0rc2","type":"pypi","namespace":"","name":"keystone","version":"16.0.0.0rc2","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"16.0.1","latest_non_vulnerable_version":"2014.2.4","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35455?format=json","vulnerability_id":"VCID-91yw-81v7-jbay","summary":"OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)","references":[{"reference_url":"https://access.redhat.com/errata/RHSA-2019:4358","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2019:4358"},{"reference_url":"https://bugs.launchpad.net/keystone/+bug/1855080","reference_id":"","reference_type":"","scores":[],"url":"https://bugs.launchpad.net/keystone/+bug/1855080"},{"reference_url":"https://review.opendev.org/#/c/697355/","reference_id":"","reference_type":"","scores":[],"url":"https://review.opendev.org/#/c/697355/"},{"reference_url":"https://review.opendev.org/#/c/697611/","reference_id":"","reference_type":"","scores":[],"url":"https://review.opendev.org/#/c/697611/"},{"reference_url":"https://review.opendev.org/#/c/697731/","reference_id":"","reference_type":"","scores":[],"url":"https://review.opendev.org/#/c/697731/"},{"reference_url":"https://security.openstack.org/ossa/OSSA-2019-006.html","reference_id":"","reference_type":"","scores":[],"url":"https://security.openstack.org/ossa/OSSA-2019-006.html"},{"reference_url":"https://usn.ubuntu.com/4262-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4262-1/"},{"reference_url":"http://www.openwall.com/lists/oss-security/2019/12/11/8","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2019/12/11/8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/14686?format=json","purl":"pkg:pypi/keystone@16.0.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@16.0.1"}],"aliases":["CVE-2019-19687","PYSEC-2019-29"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-91yw-81v7-jbay"}],"fixing_vulnerabilities":[],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@16.0.0.0rc2"}