https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:41:07 +0000 https://cve.radiocsirt.org/vuln/cnvd-2020-35477 cnvd-2020-35477 https://cve.radiocsirt.org/vuln/cnvd-2020-35477 https://cve.radiocsirt.org/vuln/euvd-2026-41367 EUVD-2026-41367 https://cve.radiocsirt.org/vuln/euvd-2026-41367 https://cve.radiocsirt.org/vuln/fkie_cve-2020-12690 <p>An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.</p> <p>An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-12690 https://cve.radiocsirt.org/vuln/ghsa-6m8p-x4qw-gh5j <p><strong>Affected:</strong> PyPI: keystone</p> <p>An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.</p> <p><strong>Affected:</strong> PyPI: keystone</p> <p>An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.</p> https://cve.radiocsirt.org/vuln/ghsa-6m8p-x4qw-gh5j https://cve.radiocsirt.org/vuln/gsd-2020-12690 gsd-2020-12690 https://cve.radiocsirt.org/vuln/gsd-2020-12690 https://cve.radiocsirt.org/vuln/pysec-2020-54 <p><strong>Affected:</strong> PyPI: keystone</p> <p>An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.</p> <p><strong>Affected:</strong> PyPI: keystone</p> <p>An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.</p> https://cve.radiocsirt.org/vuln/pysec-2020-54 https://cve.radiocsirt.org/vuln/rhsa-2020:3102 <p>openstack-keystone: EC2 and credential endpoints are not protected from a scoped context openstack-keystone: OAuth1 request token authorize silently ignores roles parameter openstack-keystone: Credentials endpoint policy logic allows changing credential owner and target project ID openstack-keystone: failure to check signature TTL of the EC2 credential auth method</p> <p>openstack-keystone: EC2 and credential endpoints are not protected from a scoped context openstack-keystone: OAuth1 request token authorize silently ignores roles parameter openstack-keystone: Credentials endpoint policy logic allows changing credential owner and target project ID openstack-keystone: failure to check signature TTL of the EC2 credential auth method</p> https://cve.radiocsirt.org/vuln/rhsa-2020:3102 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-12690 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: keystone, Ubuntu:18.04:LTS: keystone</p> <p>An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: keystone, Ubuntu:18.04:LTS: keystone</p> <p>An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-12690