In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may byp...

References

• advisory http://www.securityfocus.com/bid/104930
• advisory https://access.redhat.com/errata/RHSA-2018:2523
• advisory https://access.redhat.com/errata/RHSA-2018:2533
• advisory https://access.redhat.com/errata/RHSA-2018:2543
• advisory https://www.debian.org/security/2018/dsa-4275
• patch http://www.openwall.com/lists/oss-security/2018/07/25/2