Medium severity6.8NVD Advisory· Published Jul 19, 2018· Updated Jun 17, 2026
CVE-2017-2673
CVE-2017-2673
Description
An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
keystonePyPI | >= 9.0.0, <= 9.3.0 | — |
keystonePyPI | >= 10.0.0, < 10.0.2 | 10.0.2 |
keystonePyPI | >= 11.0.0, < 11.0.1 | 11.0.1 |
Affected products
1Patches
Vulnerability mechanics
References
13- seclists.org/oss-sec/2017/q2/125nvdMailing ListPatchThird Party AdvisoryWEB
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingPatchVendor AdvisoryWEB
- bugs.launchpad.net/keystone/+bug/1677723nvdExploitPatchThird Party AdvisoryWEB
- www.securityfocus.com/bid/98032nvdThird Party AdvisoryVDB EntryWEB
- access.redhat.com/errata/RHSA-2017:1461nvdVendor AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:1597nvdVendor AdvisoryWEB
- github.com/advisories/GHSA-j36m-hv43-7w7mghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2017-2673ghsaADVISORY
- access.redhat.com/security/cve/CVE-2017-2673ghsaWEB
- bugzilla.redhat.com/show_bug.cgighsaWEB
- github.com/openstack/keystone/commit/05a129e54573b6cbda1ec095f4526f2b9ba90a90ghsaWEB
- github.com/openstack/keystone/commit/2139639eeabc8f6941f4461fc87d609cde3118c2ghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2018-152.yamlghsaWEB
News mentions
0No linked articles in our index yet.