[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <cb27a1fa-c1f5-41c2-8e12-b7a183ea2aba@gmail.com>
Date: Tue, 4 Nov 2025 18:15:23 -0500
From: Demi Marie Obenour <demiobenour@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: [OSSA-2025-002] OpenStack Keystone:
Unauthenticated access to EC2/S3 token endpoints can grant Keystone
authorization (CVE PENDING)
On 11/4/25 10:01, Jeremy Stanley wrote:
> =========================================================================
> OSSA-2025-002: Unauthenticated access to EC2/S3 token endpoints can grant
> Keystone authorization
> =========================================================================
>
> :Date: November 04, 2025
> :CVE: PENDING
>
> Affects
> ~~~~~~~
> - Keystone: <26.0.1, ==27.0.0, ==28.0.0
>
> Description
> ~~~~~~~~~~~
> kay reported a vulnerability in Keystone’s ec2tokens and s3tokens
> APIs. By sending those endpoints a valid AWS Signature (e.g., from a
> presigned S3 URL), an unauthenticated attacker may obtain Keystone
> authorization (ec2tokens can yield a fully scoped token; s3tokens
> can reveal scope accepted by some services), resulting in
> unauthorized access and privilege escalation. Deployments where
> /v3/ec2tokens or /v3/s3tokens are reachable by unauthenticated
> clients (e.g., exposed on a public API) are affected.
Which account will the tokens belong to? Is it the one that signed
the URL?
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Download attachment "OpenPGP_0xB288B55FFF9C22C1.asc" of type "application/pgp-keys" (7141 bytes)
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
