{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/217841?format=json","vulnerability_id":"VCID-91cc-hzfb-3kek","summary":"OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)","aliases":[{"alias":"PYSEC-2019-99"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/56087?format=json","purl":"pkg:pypi/keystone@16.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3umd-756n-qqbx"},{"vulnerability":"VCID-bbem-sea4-3ub4"},{"vulnerability":"VCID-c18s-qdf4-3kdh"},{"vulnerability":"VCID-esad-mak2-8bg2"},{"vulnerability":"VCID-fhme-n8v8-ybev"},{"vulnerability":"VCID-kzaw-9ex3-s3d5"},{"vulnerability":"VCID-ngkx-25ft-8qhj"},{"vulnerability":"VCID-nmb8-wq4u-2ug7"},{"vulnerability":"VCID-saua-gpf5-2uhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@16.0.1"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52840?format=json","purl":"pkg:pypi/keystone@12.0.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3umd-756n-qqbx"},{"vulnerability":"VCID-91cc-hzfb-3kek"},{"vulnerability":"VCID-bbem-sea4-3ub4"},{"vulnerability":"VCID-c18s-qdf4-3kdh"},{"vulnerability":"VCID-fhme-n8v8-ybev"},{"vulnerability":"VCID-jc9x-jf2k-t3h9"},{"vulnerability":"VCID-kzaw-9ex3-s3d5"},{"vulnerability":"VCID-nmb8-wq4u-2ug7"},{"vulnerability":"VCID-nsx2-6bs2-7bcq"},{"vulnerability":"VCID-p1m3-dt99-ruar"},{"vulnerability":"VCID-saua-gpf5-2uhk"},{"vulnerability":"VCID-x7zb-y9a8-tygv"},{"vulnerability":"VCID-xfds-wmnb-qkcj"},{"vulnerability":"VCID-xr4p-a78v-9bb6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@12.0.2"},{"url":"http://public2.vulnerablecode.io/api/packages/52841?format=json","purl":"pkg:pypi/keystone@12.0.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3umd-756n-qqbx"},{"vulnerability":"VCID-91cc-hzfb-3kek"},{"vulnerability":"VCID-bbem-sea4-3ub4"},{"vulnerability":"VCID-c18s-qdf4-3kdh"},{"vulnerability":"VCID-fhme-n8v8-ybev"},{"vulnerability":"VCID-jc9x-jf2k-t3h9"},{"vulnerability":"VCID-kzaw-9ex3-s3d5"},{"vulnerability":"VCID-nmb8-wq4u-2ug7"},{"vulnerability":"VCID-nsx2-6bs2-7bcq"},{"vulnerability":"VCID-p1m3-dt99-ruar"},{"vulnerability":"VCID-saua-gpf5-2uhk"},{"vulnerability":"VCID-x7zb-y9a8-tygv"},{"vulnerability":"VCID-xfds-wmnb-qkcj"},{"vulnerability":"VCID-xr4p-a78v-9bb6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@12.0.3"},{"url":"http://public2.vulnerablecode.io/api/packages/52842?format=json","purl":"pkg:pypi/keystone@13.0.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3umd-756n-qqbx"},{"vulnerability":"VCID-91cc-hzfb-3kek"},{"vulnerability":"VCID-bbem-sea4-3ub4"},{"vulnerability":"VCID-c18s-qdf4-3kdh"},{"vulnerability":"VCID-fhme-n8v8-ybev"},{"vulnerability":"VCID-jc9x-jf2k-t3h9"},{"vulnerability":"VCID-kzaw-9ex3-s3d5"},{"vulnerability":"VCID-ngkx-25ft-8qhj"},{"vulnerability":"VCID-nmb8-wq4u-2ug7"},{"vulnerability":"VCID-nsx2-6bs2-7bcq"},{"vulnerability":"VCID-p1m3-dt99-ruar"},{"vulnerability":"VCID-saua-gpf5-2uhk"},{"vulnerability":"VCID-x7zb-y9a8-tygv"},{"vulnerability":"VCID-xfds-wmnb-qkcj"},{"vulnerability":"VCID-xr4p-a78v-9bb6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@13.0.2"},{"url":"http://public2.vulnerablecode.io/api/packages/52843?format=json","purl":"pkg:pypi/keystone@13.0.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3umd-756n-qqbx"},{"vulnerability":"VCID-91cc-hzfb-3kek"},{"vulnerability":"VCID-bbem-sea4-3ub4"},{"vulnerability":"VCID-c18s-qdf4-3kdh"},{"vulnerability":"VCID-fhme-n8v8-ybev"},{"vulnerability":"VCID-jc9x-jf2k-t3h9"},{"vulnerability":"VCID-kzaw-9ex3-s3d5"},{"vulnerability":"VCID-ngkx-25ft-8qhj"},{"vulnerability":"VCID-nmb8-wq4u-2ug7"},{"vulnerability":"VCID-nsx2-6bs2-7bcq"},{"vulnerability":"VCID-p1m3-dt99-ruar"},{"vulnerability":"VCID-saua-gpf5-2uhk"},{"vulnerability":"VCID-x7zb-y9a8-tygv"},{"vulnerability":"VCID-xfds-wmnb-qkcj"},{"vulnerability":"VCID-xr4p-a78v-9bb6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@13.0.3"},{"url":"http://public2.vulnerablecode.io/api/packages/52844?format=json","purl":"pkg:pypi/keystone@13.0.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3umd-756n-qqbx"},{"vulnerability":"VCID-91cc-hzfb-3kek"},{"vulnerability":"VCID-bbem-sea4-3ub4"},{"vulnerability":"VCID-c18s-qdf4-3kdh"},{"vulnerability":"VCID-fhme-n8v8-ybev"},{"vulnerability":"VCID-jc9x-jf2k-t3h9"},{"vulnerability":"VCID-kzaw-9ex3-s3d5"},{"vulnerability":"VCID-ngkx-25ft-8qhj"},{"vulnerability":"VCID-nmb8-wq4u-2ug7"},{"vulnerability":"VCID-nsx2-6bs2-7bcq"},{"vulnerability":"VCID-p1m3-dt99-ruar"},{"vulnerability":"VCID-saua-gpf5-2uhk"},{"vulnerability":"VCID-x7zb-y9a8-tygv"},{"vulnerability":"VCID-xfds-wmnb-qkcj"},{"vulnerability":"VCID-xr4p-a78v-9bb6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@13.0.4"},{"url":"http://public2.vulnerablecode.io/api/packages/52845?format=json","purl":"pkg:pypi/keystone@14.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3umd-756n-qqbx"},{"vulnerability":"VCID-91cc-hzfb-3kek"},{"vulnerability":"VCID-bbem-sea4-3ub4"},{"vulnerability":"VCID-c18s-qdf4-3kdh"},{"vulnerability":"VCID-esad-mak2-8bg2"},{"vulnerability":"VCID-fhme-n8v8-ybev"},{"vulnerability":"VCID-jc9x-jf2k-t3h9"},{"vulnerability":"VCID-kzaw-9ex3-s3d5"},{"vulnerability":"VCID-ngkx-25ft-8qhj"},{"vulnerability":"VCID-nmb8-wq4u-2ug7"},{"vulnerability":"VCID-nsx2-6bs2-7bcq"},{"vulnerability":"VCID-p1m3-dt99-ruar"},{"vulnerability":"VCID-saua-gpf5-2uhk"},{"vulnerability":"VCID-x7zb-y9a8-tygv"},{"vulnerability":"VCID-xfds-wmnb-qkcj"},{"vulnerability":"VCID-xr4p-a78v-9bb6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@14.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/52846?format=json","purl":"pkg:pypi/keystone@14.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3umd-756n-qqbx"},{"vulnerability":"VCID-91cc-hzfb-3kek"},{"vulnerability":"VCID-bbem-sea4-3ub4"},{"vulnerability":"VCID-c18s-qdf4-3kdh"},{"vulnerability":"VCID-esad-mak2-8bg2"},{"vulnerability":"VCID-fhme-n8v8-ybev"},{"vulnerability":"VCID-jc9x-jf2k-t3h9"},{"vulnerability":"VCID-kzaw-9ex3-s3d5"},{"vulnerability":"VCID-ngkx-25ft-8qhj"},{"vulnerability":"VCID-nmb8-wq4u-2ug7"},{"vulnerability":"VCID-nsx2-6bs2-7bcq"},{"vulnerability":"VCID-p1m3-dt99-ruar"},{"vulnerability":"VCID-saua-gpf5-2uhk"},{"vulnerability":"VCID-x7zb-y9a8-tygv"},{"vulnerability":"VCID-xfds-wmnb-qkcj"},{"vulnerability":"VCID-xr4p-a78v-9bb6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@14.0.1"},{"url":"http://public2.vulnerablecode.io/api/packages/52847?format=json","purl":"pkg:pypi/keystone@14.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3umd-756n-qqbx"},{"vulnerability":"VCID-91cc-hzfb-3kek"},{"vulnerability":"VCID-bbem-sea4-3ub4"},{"vulnerability":"VCID-c18s-qdf4-3kdh"},{"vulnerability":"VCID-esad-mak2-8bg2"},{"vulnerability":"VCID-fhme-n8v8-ybev"},{"vulnerability":"VCID-jc9x-jf2k-t3h9"},{"vulnerability":"VCID-kzaw-9ex3-s3d5"},{"vulnerability":"VCID-ngkx-25ft-8qhj"},{"vulnerability":"VCID-nmb8-wq4u-2ug7"},{"vulnerability":"VCID-nsx2-6bs2-7bcq"},{"vulnerability":"VCID-saua-gpf5-2uhk"},{"vulnerability":"VCID-x7zb-y9a8-tygv"},{"vulnerability":"VCID-xfds-wmnb-qkcj"},{"vulnerability":"VCID-xr4p-a78v-9bb6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@14.1.0"},{"url":"http://public2.vulnerablecode.io/api/packages/56079?format=json","purl":"pkg:pypi/keystone@14.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3umd-756n-qqbx"},{"vulnerability":"VCID-91cc-hzfb-3kek"},{"vulnerability":"VCID-bbem-sea4-3ub4"},{"vulnerability":"VCID-c18s-qdf4-3kdh"},{"vulnerability":"VCID-esad-mak2-8bg2"},{"vulnerability":"VCID-fhme-n8v8-ybev"},{"vulnerability":"VCID-jc9x-jf2k-t3h9"},{"vulnerability":"VCID-kzaw-9ex3-s3d5"},{"vulnerability":"VCID-ngkx-25ft-8qhj"},{"vulnerability":"VCID-nmb8-wq4u-2ug7"},{"vulnerability":"VCID-nsx2-6bs2-7bcq"},{"vulnerability":"VCID-saua-gpf5-2uhk"},{"vulnerability":"VCID-x7zb-y9a8-tygv"},{"vulnerability":"VCID-xfds-wmnb-qkcj"},{"vulnerability":"VCID-xr4p-a78v-9bb6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@14.2.0"},{"url":"http://public2.vulnerablecode.io/api/packages/56080?format=json","purl":"pkg:pypi/keystone@15.0.0.0rc1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3umd-756n-qqbx"},{"vulnerability":"VCID-91cc-hzfb-3kek"},{"vulnerability":"VCID-bbem-sea4-3ub4"},{"vulnerability":"VCID-c18s-qdf4-3kdh"},{"vulnerability":"VCID-esad-mak2-8bg2"},{"vulnerability":"VCID-fhme-n8v8-ybev"},{"vulnerability":"VCID-jc9x-jf2k-t3h9"},{"vulnerability":"VCID-kzaw-9ex3-s3d5"},{"vulnerability":"VCID-ngkx-25ft-8qhj"},{"vulnerability":"VCID-nmb8-wq4u-2ug7"},{"vulnerability":"VCID-nsx2-6bs2-7bcq"},{"vulnerability":"VCID-saua-gpf5-2uhk"},{"vulnerability":"VCID-x7zb-y9a8-tygv"},{"vulnerability":"VCID-xfds-wmnb-qkcj"},{"vulnerability":"VCID-xr4p-a78v-9bb6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@15.0.0.0rc1"},{"url":"http://public2.vulnerablecode.io/api/packages/56081?format=json","purl":"pkg:pypi/keystone@15.0.0.0rc2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3umd-756n-qqbx"},{"vulnerability":"VCID-91cc-hzfb-3kek"},{"vulnerability":"VCID-bbem-sea4-3ub4"},{"vulnerability":"VCID-c18s-qdf4-3kdh"},{"vulnerability":"VCID-esad-mak2-8bg2"},{"vulnerability":"VCID-fhme-n8v8-ybev"},{"vulnerability":"VCID-jc9x-jf2k-t3h9"},{"vulnerability":"VCID-kzaw-9ex3-s3d5"},{"vulnerability":"VCID-ngkx-25ft-8qhj"},{"vulnerability":"VCID-nmb8-wq4u-2ug7"},{"vulnerability":"VCID-nsx2-6bs2-7bcq"},{"vulnerability":"VCID-saua-gpf5-2uhk"},{"vulnerability":"VCID-x7zb-y9a8-tygv"},{"vulnerability":"VCID-xfds-wmnb-qkcj"},{"vulnerability":"VCID-xr4p-a78v-9bb6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@15.0.0.0rc2"},{"url":"http://public2.vulnerablecode.io/api/packages/56082?format=json","purl":"pkg:pypi/keystone@15.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3umd-756n-qqbx"},{"vulnerability":"VCID-91cc-hzfb-3kek"},{"vulnerability":"VCID-bbem-sea4-3ub4"},{"vulnerability":"VCID-c18s-qdf4-3kdh"},{"vulnerability":"VCID-esad-mak2-8bg2"},{"vulnerability":"VCID-fhme-n8v8-ybev"},{"vulnerability":"VCID-jc9x-jf2k-t3h9"},{"vulnerability":"VCID-kzaw-9ex3-s3d5"},{"vulnerability":"VCID-ngkx-25ft-8qhj"},{"vulnerability":"VCID-nmb8-wq4u-2ug7"},{"vulnerability":"VCID-nsx2-6bs2-7bcq"},{"vulnerability":"VCID-saua-gpf5-2uhk"},{"vulnerability":"VCID-x7zb-y9a8-tygv"},{"vulnerability":"VCID-xfds-wmnb-qkcj"},{"vulnerability":"VCID-xr4p-a78v-9bb6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@15.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/56083?format=json","purl":"pkg:pypi/keystone@15.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3umd-756n-qqbx"},{"vulnerability":"VCID-91cc-hzfb-3kek"},{"vulnerability":"VCID-bbem-sea4-3ub4"},{"vulnerability":"VCID-c18s-qdf4-3kdh"},{"vulnerability":"VCID-esad-mak2-8bg2"},{"vulnerability":"VCID-fhme-n8v8-ybev"},{"vulnerability":"VCID-kzaw-9ex3-s3d5"},{"vulnerability":"VCID-ngkx-25ft-8qhj"},{"vulnerability":"VCID-nmb8-wq4u-2ug7"},{"vulnerability":"VCID-saua-gpf5-2uhk"},{"vulnerability":"VCID-x7zb-y9a8-tygv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@15.0.1"},{"url":"http://public2.vulnerablecode.io/api/packages/56084?format=json","purl":"pkg:pypi/keystone@16.0.0.0rc1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3umd-756n-qqbx"},{"vulnerability":"VCID-91cc-hzfb-3kek"},{"vulnerability":"VCID-bbem-sea4-3ub4"},{"vulnerability":"VCID-c18s-qdf4-3kdh"},{"vulnerability":"VCID-esad-mak2-8bg2"},{"vulnerability":"VCID-fhme-n8v8-ybev"},{"vulnerability":"VCID-kzaw-9ex3-s3d5"},{"vulnerability":"VCID-ngkx-25ft-8qhj"},{"vulnerability":"VCID-nmb8-wq4u-2ug7"},{"vulnerability":"VCID-saua-gpf5-2uhk"},{"vulnerability":"VCID-x7zb-y9a8-tygv"},{"vulnerability":"VCID-xfds-wmnb-qkcj"},{"vulnerability":"VCID-xr4p-a78v-9bb6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@16.0.0.0rc1"},{"url":"http://public2.vulnerablecode.io/api/packages/56085?format=json","purl":"pkg:pypi/keystone@16.0.0.0rc2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3umd-756n-qqbx"},{"vulnerability":"VCID-91cc-hzfb-3kek"},{"vulnerability":"VCID-bbem-sea4-3ub4"},{"vulnerability":"VCID-c18s-qdf4-3kdh"},{"vulnerability":"VCID-esad-mak2-8bg2"},{"vulnerability":"VCID-fhme-n8v8-ybev"},{"vulnerability":"VCID-kzaw-9ex3-s3d5"},{"vulnerability":"VCID-ngkx-25ft-8qhj"},{"vulnerability":"VCID-nmb8-wq4u-2ug7"},{"vulnerability":"VCID-saua-gpf5-2uhk"},{"vulnerability":"VCID-x7zb-y9a8-tygv"},{"vulnerability":"VCID-xfds-wmnb-qkcj"},{"vulnerability":"VCID-xr4p-a78v-9bb6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@16.0.0.0rc2"},{"url":"http://public2.vulnerablecode.io/api/packages/56086?format=json","purl":"pkg:pypi/keystone@16.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3umd-756n-qqbx"},{"vulnerability":"VCID-91cc-hzfb-3kek"},{"vulnerability":"VCID-bbem-sea4-3ub4"},{"vulnerability":"VCID-c18s-qdf4-3kdh"},{"vulnerability":"VCID-esad-mak2-8bg2"},{"vulnerability":"VCID-fhme-n8v8-ybev"},{"vulnerability":"VCID-jc9x-jf2k-t3h9"},{"vulnerability":"VCID-kzaw-9ex3-s3d5"},{"vulnerability":"VCID-ngkx-25ft-8qhj"},{"vulnerability":"VCID-nmb8-wq4u-2ug7"},{"vulnerability":"VCID-nsx2-6bs2-7bcq"},{"vulnerability":"VCID-saua-gpf5-2uhk"},{"vulnerability":"VCID-x7zb-y9a8-tygv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@16.0.0"}],"references":[{"reference_url":"https://access.redhat.com/errata/RHSA-2019:4358","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2019:4358"},{"reference_url":"https://bugs.launchpad.net/keystone/+bug/1855080","reference_id":"","reference_type":"","scores":[],"url":"https://bugs.launchpad.net/keystone/+bug/1855080"},{"reference_url":"https://review.opendev.org/#/c/697355/","reference_id":"","reference_type":"","scores":[],"url":"https://review.opendev.org/#/c/697355/"},{"reference_url":"https://review.opendev.org/#/c/697611/","reference_id":"","reference_type":"","scores":[],"url":"https://review.opendev.org/#/c/697611/"},{"reference_url":"https://review.opendev.org/#/c/697731/","reference_id":"","reference_type":"","scores":[],"url":"https://review.opendev.org/#/c/697731/"},{"reference_url":"https://security.openstack.org/ossa/OSSA-2019-006.html","reference_id":"","reference_type":"","scores":[],"url":"https://security.openstack.org/ossa/OSSA-2019-006.html"},{"reference_url":"https://usn.ubuntu.com/4262-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4262-1/"},{"reference_url":"http://www.openwall.com/lists/oss-security/2019/12/11/8","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2019/12/11/8"}],"weaknesses":[],"exploits":[],"severity_range_score":null,"exploitability":"0.5","weighted_severity":"0.0","risk_score":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-91cc-hzfb-3kek"}