{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35554?format=json","vulnerability_id":"VCID-kd2c-53va-qbcg","summary":"An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.","aliases":[{"alias":"CVE-2020-12691"},{"alias":"PYSEC-2020-55"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/14682?format=json","purl":"pkg:pypi/keystone@15.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-91yw-81v7-jbay"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@15.0.1"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/12605?format=json","purl":"pkg:pypi/keystone@12.0.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"},{"vulnerability":"VCID-zvfa-f3nf-gqh8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@12.0.2"},{"url":"http://public2.vulnerablecode.io/api/packages/12606?format=json","purl":"pkg:pypi/keystone@12.0.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"},{"vulnerability":"VCID-zvfa-f3nf-gqh8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@12.0.3"},{"url":"http://public2.vulnerablecode.io/api/packages/12607?format=json","purl":"pkg:pypi/keystone@13.0.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"},{"vulnerability":"VCID-zvfa-f3nf-gqh8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@13.0.2"},{"url":"http://public2.vulnerablecode.io/api/packages/12608?format=json","purl":"pkg:pypi/keystone@13.0.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"},{"vulnerability":"VCID-zvfa-f3nf-gqh8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@13.0.3"},{"url":"http://public2.vulnerablecode.io/api/packages/12609?format=json","purl":"pkg:pypi/keystone@13.0.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"},{"vulnerability":"VCID-zvfa-f3nf-gqh8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@13.0.4"},{"url":"http://public2.vulnerablecode.io/api/packages/12610?format=json","purl":"pkg:pypi/keystone@14.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"},{"vulnerability":"VCID-zvfa-f3nf-gqh8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@14.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/12611?format=json","purl":"pkg:pypi/keystone@14.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"},{"vulnerability":"VCID-zvfa-f3nf-gqh8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@14.0.1"},{"url":"http://public2.vulnerablecode.io/api/packages/12612?format=json","purl":"pkg:pypi/keystone@14.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@14.1.0"},{"url":"http://public2.vulnerablecode.io/api/packages/14678?format=json","purl":"pkg:pypi/keystone@14.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@14.2.0"},{"url":"http://public2.vulnerablecode.io/api/packages/14681?format=json","purl":"pkg:pypi/keystone@15.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@15.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/14679?format=json","purl":"pkg:pypi/keystone@15.0.0.0rc1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@15.0.0.0rc1"},{"url":"http://public2.vulnerablecode.io/api/packages/14680?format=json","purl":"pkg:pypi/keystone@15.0.0.0rc2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@15.0.0.0rc2"}],"references":[{"reference_url":"https://bugs.launchpad.net/keystone/+bug/1872733","reference_id":"","reference_type":"","scores":[],"url":"https://bugs.launchpad.net/keystone/+bug/1872733"},{"reference_url":"https://lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2@%3Ccommits.druid.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2@%3Ccommits.druid.apache.org%3E"},{"reference_url":"https://security.openstack.org/ossa/OSSA-2020-004.html","reference_id":"","reference_type":"","scores":[],"url":"https://security.openstack.org/ossa/OSSA-2020-004.html"},{"reference_url":"https://usn.ubuntu.com/4480-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4480-1/"},{"reference_url":"https://www.openwall.com/lists/oss-security/2020/05/06/5","reference_id":"","reference_type":"","scores":[],"url":"https://www.openwall.com/lists/oss-security/2020/05/06/5"},{"reference_url":"http://www.openwall.com/lists/oss-security/2020/05/07/2","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2020/05/07/2"}],"weaknesses":[],"exploits":[],"severity_range_score":null,"exploitability":null,"weighted_severity":null,"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kd2c-53va-qbcg"}