Test ID:	1.3.6.1.4.1.25623.1.0.844560
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-4480-1)
Summary:	The remote host is missing an update for the 'keystone' package(s) announced via the USN-4480-1 advisory.
Description:	Summary: The remote host is missing an update for the 'keystone' package(s) announced via the USN-4480-1 advisory. Vulnerability Insight: It was discovered that OpenStack Keystone incorrectly handled EC2 credentials. An authenticated attacker with a limited scope could possibly create EC2 credentials with escalated permissions. (CVE-2020-12689, CVE-2020-12691) It was discovered that OpenStack Keystone incorrectly handled the list of roles provided with OAuth1 access tokens. An authenticated user could possibly end up with more role assignments than intended. (CVE-2020-12690) It was discovered that OpenStack Keystone incorrectly handled EC2 signature TTL checks. A remote attacker could possibly use this issue to reuse Authorization headers. (CVE-2020-12692) Affected Software/OS: 'keystone' package(s) on Ubuntu 18.04. Solution: Please install the updated package(s). CVSS Score: 6.5 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-12689 https://bugs.launchpad.net/keystone/+bug/1872735 https://www.openwall.com/lists/oss-security/2020/05/06/5 https://lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2@%3Ccommits.druid.apache.org%3E http://www.openwall.com/lists/oss-security/2020/05/07/2 https://usn.ubuntu.com/4480-1/ Common Vulnerability Exposure (CVE) ID: CVE-2020-12690 https://bugs.launchpad.net/keystone/+bug/1873290 https://www.openwall.com/lists/oss-security/2020/05/06/6 https://lists.apache.org/thread.html/re237267da268c690df5e1c6ea6a38a7fc11617725e8049490f58a6fa@%3Ccommits.druid.apache.org%3E http://www.openwall.com/lists/oss-security/2020/05/07/3 Common Vulnerability Exposure (CVE) ID: CVE-2020-12691 https://bugs.launchpad.net/keystone/+bug/1872733 Common Vulnerability Exposure (CVE) ID: CVE-2020-12692 https://bugs.launchpad.net/keystone/+bug/1872737 https://www.openwall.com/lists/oss-security/2020/05/06/4 http://www.openwall.com/lists/oss-security/2020/05/07/1
Copyright	Copyright (C) 2020 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.