)]}'
{"security-notes/OSSN-0083":[{"author":{"_account_id":28011,"name":"Nicholas Tait","email":"ntait@redhat.com","username":"nickthetait"},"change_message_id":"624d278816924a9620bdd28f2c03be00f9e69112","unresolved":false,"context_lines":[{"line_number":6,"context_line":"secure configuration than would be expected."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"### Affected Services / Software ###"},{"line_number":9,"context_line":"OpenStack Identity Service (Keystone). OpenStack releases ????"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Discussion ###"},{"line_number":12,"context_line":"Deployments affected by this problem would have modified the"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"bf659307_ad54a455","line":9,"updated":"2018-04-06 22:25:24.000000000","message":"Wasn\u0027t able to figure out the releases affected by this bug...","commit_id":"fd97d04f8e9b143a988c3de2d21a86ec81491262"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"dd268866a11f36f8440ca6a982d6931e460f579c","unresolved":false,"context_lines":[{"line_number":6,"context_line":"secure configuration than would be expected."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"### Affected Services / Software ###"},{"line_number":9,"context_line":"OpenStack Identity Service (Keystone). OpenStack releases ????"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Discussion ###"},{"line_number":12,"context_line":"Deployments affected by this problem would have modified the"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"bf659307_f0d188cd","line":9,"in_reply_to":"bf659307_8972e9ac","updated":"2018-04-12 19:37:55.000000000","message":"\"OpenStack Identity Service (keystone) versions through Mitaka, as well as Newton prior to 10.0.3 and Ocata prior to 11.0.3.\"\n\nMaybe something like that?","commit_id":"fd97d04f8e9b143a988c3de2d21a86ec81491262"},{"author":{"_account_id":21797,"name":"Jeremy Liu","display_name":"Jeremy Liu","email":"liujiong.cc@gmail.com","username":"liujiong"},"change_message_id":"e7d21de211840d35fadb48a7297144461ecaca70","unresolved":false,"context_lines":[{"line_number":6,"context_line":"secure configuration than would be expected."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"### Affected Services / Software ###"},{"line_number":9,"context_line":"OpenStack Identity Service (Keystone). OpenStack releases ????"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Discussion ###"},{"line_number":12,"context_line":"Deployments affected by this problem would have modified the"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"bf659307_8972e9ac","line":9,"in_reply_to":"bf659307_ad54a455","updated":"2018-04-08 10:19:15.000000000","message":"That bug fix was originally merged into Pike, and backported to Ocata and Newton branches. So it should affect three releases. Not sure whether we should mention Mitaka as well.","commit_id":"fd97d04f8e9b143a988c3de2d21a86ec81491262"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"dd268866a11f36f8440ca6a982d6931e460f579c","unresolved":false,"context_lines":[{"line_number":9,"context_line":"OpenStack Identity Service (Keystone). OpenStack releases ????"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Discussion ###"},{"line_number":12,"context_line":"Deployments affected by this problem would have modified the"},{"line_number":13,"context_line":"\"get_identity_providers\" rule or changed the \"default\" rule in"},{"line_number":14,"context_line":"keystone\u0027s `policy.json`."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"A spelling mistake in the default policy configuration caused these"},{"line_number":17,"context_line":"rules to be ignored. As a result operators that attempted to restrict"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"bf659307_d03804ef","line":14,"range":{"start_line":12,"start_character":0,"end_line":14,"end_character":25},"updated":"2018-04-12 19:37:55.000000000","message":"This wording seems off. According to the keystone bug, if deployments had modified the rule to be (singular) or changed the default rule, they would not be affected.","commit_id":"fd97d04f8e9b143a988c3de2d21a86ec81491262"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"dd268866a11f36f8440ca6a982d6931e460f579c","unresolved":false,"context_lines":[{"line_number":18,"context_line":"this API were unlikely to actually enforce it."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"### Recommended Actions ###"},{"line_number":21,"context_line":"Update Keystone to a minimum version of 11.0.3, 10.0.3, or 12.0.0.0b3."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Update any lingering rules: `identity:get_identity_providers` should"},{"line_number":24,"context_line":"be changed to `identity:get_identity_provider`."}],"source_content_type":"application/octet-stream","patch_set":1,"id":"bf659307_d06a44eb","line":21,"range":{"start_line":21,"start_character":40,"end_line":21,"end_character":46},"updated":"2018-04-12 19:37:55.000000000","message":"We could put the release name here as well for more clarity, something like:\n\n\"Update keystone to a minimum version of 12.0.0.0b3. This issue was also fixed in versions 10.0.3 (Newton) and 11.0.3 (Ocata).\"","commit_id":"fd97d04f8e9b143a988c3de2d21a86ec81491262"}]}