Stanislaw Pitucha 9aaa0e77ad OSSN-0021 - Keystone trusts on compromised account ...

Adding a description of the issue of verifying Keystone trust in case
of account compromise. Including examples of API interaction to help
check the situation.

Closes-Bug: #1341849
Change-Id: Iaf38c214d553dfd4dfe29dac9dc1496c061fb765

2014-07-25 15:20:09 +01:00

..

OSSN-0001

Add previously published security notes

2014-02-12 21:35:18 -08:00

OSSN-0002

Add previously published security notes

2014-02-12 21:35:18 -08:00

OSSN-0003

Add previously published security notes

2014-02-12 21:35:18 -08:00

OSSN-0004

Add previously published security notes

2014-02-12 21:35:18 -08:00

OSSN-0005

Add previously published security notes

2014-02-12 21:35:18 -08:00

OSSN-0006

Add previously published security notes

2014-02-12 21:35:18 -08:00

OSSN-0007

Add OSSN-0007 - unsecure libvirt live migration instructions

2014-03-06 14:59:19 -08:00

OSSN-0008

Add OSSN-0008 - DoS attack on noVNC/SPICE console due to lack of limiting

2014-03-09 09:58:57 -07:00

OSSN-0009

Add OSSN-0009 - Potential token revocation abuse via group membership

2014-04-01 19:48:58 -07:00

OSSN-0010

Add OSSN-0010 - Sample Keystone v3 policy exposes privilege escalation

2014-04-17 09:36:16 -07:00

OSSN-0011

Add OSSN-0011 - Heat templates with invalid references allows unintended network access

2014-04-04 15:18:26 -07:00

OSSN-0012

Correct typo in OSSN-0012 title

2014-04-10 00:13:58 -07:00

OSSN-0013

Correct workaround in OSSN-0013

2014-06-05 22:18:36 -07:00

OSSN-0014

Add OSSN-0014 - Cinder drivers set insecure file permissions

2014-05-29 11:59:35 -07:00

OSSN-0015

Add OSSN-0015 - Glance allows non-admin users to create public images

2014-05-29 13:28:21 -07:00

OSSN-0016

Cinder secure wipe misconfiguration will result in no wipe, on

2014-06-02 18:17:13 +01:00

OSSN-0017

Adding OSSN-0017 - Session-fixation vulnerability in Horizon when using the default signed cookie sessions

2014-06-18 13:44:23 -07:00

OSSN-0018

Add OSSN-0018 - Dangerous network configuration

2014-06-18 17:10:54 +01:00

OSSN-0019

Adding OSSN-0019 - SSH Pool using auto-add policy.

2014-06-27 16:37:43 +01:00

OSSN-0021

OSSN-0021 - Keystone trusts on compromised account

2014-07-25 15:20:09 +01:00