{"id":"CVE-2019-19687","aliases":["DEBIAN-CVE-2019-19687","EUVD-2019-0072","GHSA-2j23-fwqm-mgwr","PYSEC-2019-29","RHEA-2020:0283","RHSA-2019:4358","UBUNTU-CVE-2019-19687"],"status":"published","title":"OpenStack Keystone Credential Leakage","description":"OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0178,"percentile":0.78542,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-522"],"published":"2019-12-09T17:14:14Z","modified":"2026-10-24T10:30:35Z","fixes":[{"ecosystem":"PyPI","package":"keystone","fixed_in":["15.0.1","16.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"keystone","fixed_in":["2:16.0.0-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"keystone","fixed_in":["2:16.0.0-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"keystone","fixed_in":["2:16.0.0-5"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:15::el8","package":"openstack-keystone","fixed_in":["1:15.0.1-0.20190720060412.5f27c4b.1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:15::el8","package":"python3-keystone","fixed_in":["1:15.0.1-0.20190720060412.5f27c4b.1.el8ost"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.0"},{"last_affected":"15.0.0"},{"fixed":"15.0.1"}]}],"versions":["15.0.0"]},{"source":"ghsa","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"last_affected":"16.0.0"},{"fixed":"16.0.1"}]}],"versions":["16.0.0"]},{"source":"osv","ecosystem":"Debian:12","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.0.0-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.0.0-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.0.0-5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.0"},{"fixed":"15.0.1"}]}],"versions":["15.0.0"]},{"source":"osv","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"fixed":"16.0.1"}]}],"versions":["16.0.0"]},{"source":"osv","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.0.1"}]}],"versions":["12.0.2","12.0.3","13.0.2","13.0.3","13.0.4","14.0.0","14.0.1","14.1.0","14.2.0","15.0.0","15.0.0.0rc1","15.0.0.0rc2","15.0.1","16.0.0","16.0.0.0rc1","16.0.0.0rc2"]},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"openstack-mistral","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-0.20191125120837.6651519.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"openstack-mistral-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-0.20191125120837.6651519.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"openstack-mistral-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-0.20191125120837.6651519.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"openstack-mistral-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-0.20191125120837.6651519.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"openstack-mistral-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-0.20191125120837.6651519.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"openstack-mistral-event-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-0.20191125120837.6651519.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"openstack-mistral-executor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-0.20191125120837.6651519.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"openstack-mistral-notifier","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-0.20191125120837.6651519.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"python3-mistral","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-0.20191125120837.6651519.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.0.1-0.20191210095025.bd3f637.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"python3-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.0.1-0.20191210095025.bd3f637.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:15::el8","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.0.1-0.20190720060412.5f27c4b.1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:15::el8","package":"python3-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.0.1-0.20190720060412.5f27c4b.1.el8ost"}]}]}],"products":[{"vendor":"openstack","product":"keystone"}],"references":[{"url":"https://bugs.launchpad.net/keystone/+bug/1855080","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://review.opendev.org/#/c/697355/","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://review.opendev.org/#/c/697611/","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://review.opendev.org/#/c/697731/","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://security.openstack.org/ossa/OSSA-2019-006.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2019/12/11/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4358","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://usn.ubuntu.com/4262-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19687","tags":["advisory"]},{"url":"https://github.com/openstack/keystone/commit/17c337dbdbfb9d548ad531c2ad0483c9bce5b98f","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1781470","tags":["web","report"]},{"url":"https://git.openstack.org/cgit/openstack/keystone/commit/?id=17947516b0095c51da5cff94771247f2e7c44ee6","tags":["web"]},{"url":"https://git.openstack.org/cgit/openstack/keystone/commit/?id=17c337dbdbfb9d548ad531c2ad0483c9bce5b98f","tags":["web"]},{"url":"https://git.openstack.org/cgit/openstack/keystone/commit/?id=bd3f63787151183f4daa43578aa491856fefae5b","tags":["web"]},{"url":"https://github.com/openstack/keystone/commit/17947516b0095c51da5cff94771247f2e7c44ee6","tags":["web"]},{"url":"https://github.com/openstack/keystone/commit/bd3f63787151183f4daa43578aa491856fefae5b","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2019-29.yaml","tags":["web"]},{"url":"https://review.opendev.org/#/c/697355","tags":["web"]},{"url":"https://review.opendev.org/#/c/697611","tags":["web"]},{"url":"https://review.opendev.org/#/c/697731","tags":["web"]},{"url":"https://usn.ubuntu.com/4262-1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2j23-fwqm-mgwr","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-19687","tags":["advisory"]},{"url":"https://github.com/openstack/keystone","tags":["package"]},{"url":"https://access.redhat.com/errata/RHEA-2020:0283","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/16.0/html/release_notes/chap-technical_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1184786","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1222414","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301025","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1328124","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1339540","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1360970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1375207","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481814","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1518222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1544441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1544822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1545700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1545855","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1565012","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1575079","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1593057","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1596368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1600967","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1601926","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1613455","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1621701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1622233","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1623152","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1623685","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1625244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1625281","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1628541","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1631508","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1636634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1646397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1647005","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1649264","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1663446","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1666973","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1678521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1689816","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1691025","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1693821","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1693838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1695105","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1698021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1698577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1700396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1702048","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1703091","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1703956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1706896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1708168","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1708191","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1708330","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1710089","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1710092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1710093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1710391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1710426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1710634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1710659","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1710947","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1712561","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1716335","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1717359","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1717706","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1718380","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1719185","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1720675","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1722593","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1722890","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723451","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1724167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1724565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1725082","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1726230","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1726615","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1727158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1727229","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1728402","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1730230","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1730233","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1733257","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734301","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1735551","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1737366","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1737578","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1738447","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1738830","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1739111","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1739479","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1740158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1743569","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1744855","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1745010","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1746068","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1747426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1747931","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1749382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1751718","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1753262","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1754416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1754560","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1754984","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1757979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1758174","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1758302","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1758688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1759476","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1760410","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1760502","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1761356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1762303","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1764240","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1764508","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1765910","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1766494","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767481","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767489","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767894","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768673","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768777","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768910","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1769872","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1770907","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1771807","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1772025","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1772566","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1774581","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775575","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775731","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1776779","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1776931","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1777020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1777263","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1777368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1777529","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1777780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1777898","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1778822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1779165","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1779221","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1779277","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1779356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1779503","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1780048","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1780103","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1780266","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1780267","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1780913","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1781265","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1781363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1782406","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1782594","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1782867","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1782961","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1783299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1784160","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1784665","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1785692","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1785773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1785776","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1786465","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1787406","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788234","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788575","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788633","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789163","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1790467","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1790555","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1791364","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1791928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1793690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1793960","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1793963","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1795537","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhea-2020_0283.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3866","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768731","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3866","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-19687","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19687","tags":["advisory","report"]},{"url":"https://seclists.org/oss-sec/2019/q4/152","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4358.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-19687","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4262-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-19687","description":"OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)","status":"published","published":"2019-12-09T17:14:14Z","modified":"2024-08-05T02:25:12.373Z","updated_at":"2026-11-02T14:20:20.74896Z"}],"euvd":[{"id":"EUVD-2019-0072","description":"OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)","status":"published","published":"2019-12-09T17:14:14Z","modified":"2024-08-05T02:25:12Z","updated_at":"2026-11-03T02:40:24.842572Z"}],"ghsa":[{"id":"GHSA-2j23-fwqm-mgwr","title":"OpenStack Keystone Credential Leakage","description":"OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the `/v3/credentials` API when `enforce_scope` is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)","status":"published","published":"2022-05-24T17:02:55Z","modified":"2024-09-27T20:36:30Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:38:06.988799Z"}],"nvd":[{"id":"CVE-2019-19687","description":"OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)","status":"published","published":"2019-12-09T18:15:09.827Z","modified":"2026-06-17T02:27:03.407Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:05:38.993437Z"}],"osv":[{"id":"CVE-2019-19687","description":"OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)","status":"published","published":"2019-12-09T18:15:09.827Z","modified":"2026-10-24T10:30:35.322727497Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-19687","description":"OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)","status":"published","published":"2019-12-09T18:15:09.827Z","modified":"2026-09-21T07:02:35.485563719Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"GHSA-2j23-fwqm-mgwr","title":"OpenStack Keystone Credential Leakage","description":"OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the `/v3/credentials` API when `enforce_scope` is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)","status":"published","published":"2022-05-24T17:02:55Z","modified":"2024-09-27T20:36:29Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"RHEA-2020:0283","title":"Red Hat Enhancement Advisory: Red Hat OpenStack Platform 16.0 GA","status":"published","published":"2024-09-16T03:17:16Z","modified":"2026-08-01T10:03:00Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2019:4358","title":"Red Hat Security Advisory: openstack-keystone security update","status":"published","published":"2024-09-16T03:16:52Z","modified":"2026-08-01T10:02:59Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2019-19687","description":"OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)","status":"withdrawn","published":"2019-12-09T18:15:00Z","modified":"2026-02-04T04:12:56.011838Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"PYSEC-2019-29","description":"OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)","status":"published","published":"2019-12-09T18:15:00Z","modified":"2026-06-10T17:01:58.389944091Z","updated_at":"2026-11-02T15:52:52.192131Z"}]}}