Debian/cyborg: high 7.4
OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless
Action: Upgrade cyborg to 14.0.0-3+deb13u1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 14.0.0-3+deb13u1 | - |
Fixed versions
| 14.0.0-3+deb13u1 |
Sources
published · modified · JSON