CVE-2019-19687

Name	CVE-2019-19687
Description	OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs	946614

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
keystone (PTS)	buster, buster (security)	2:14.2.0-0+deb10u1	fixed
	bullseye	2:18.0.0-3+deb11u1	fixed
	bookworm, sid	2:22.0.0-1.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
keystone	source	jessie	(not affected)
keystone	source	stretch	(not affected)
keystone	source	buster	(not affected)
keystone	source	(unstable)	2:16.0.0-5	946614

Notes

[buster] - keystone <not-affected> (Vulnerable code introduced later)
[stretch] - keystone <not-affected> (Vulnerable code introduced later)
[jessie] - keystone <not-affected> (Vulnerable code introduced later)
https://www.openwall.com/lists/oss-security/2019/12/11/8
https://bugs.launchpad.net/keystone/+bug/1855080