IBM Security Bulletin: PowerVC is affected by an Openstack Keystone vulnerability that could allow a remote authenticated attacker to discover restricted projects (CVE-2018-14432)
Jan 18, 2019 9:00 am EST
Categorized: Medium Severity
Share this post:
PowerVC has addressed the following vulnerability. An authenticated “GET /v3/OS-FEDERATION/projects” request to the identity API may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes.
CVE(s): CVE-2018-14432
Affected product(s) and affected version(s):
| Affected Product | Affected Versions |
| IBM PowerVC Standard | 1.3.3 |
| IBM PowerVC Standard | 1.4.0 |
| IBM PowerVC Standard | 1.4.1 |
| IBM Cloud PowerVC Manager | 1.3.3 |
| IBM Cloud PowerVC Manager | 1.4.0 |
| IBM Cloud PowerVC Manager | 1.4.1 |
Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://www.ibm.com/support/docview.wss?uid=ibm10794471
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/147412
from IBM Product Security Incident Response Team https://ibm.co/2HkqL1f