bugbot adjusting priority

public

public

OpenStack Security Advisory: 2013-014
CVE: CVE-2013-2104
Date: May 28, 2013
Title: Missing expiration check in Keystone PKI tokens validation
Reporter: Eoghan Glynn (Red Hat), Alex Meade (Rackspace)
Products/Affects: Keystone (Folsom only), python-keystoneclient (0.2.0+)

Description:
Eoghan Glynn from Red Hat and Alex Meade from Rackspace both reported a
vulnerability in expiry checks for PKI tokens in the Keystone
authentication middleware. Expired tokens for authenticated users could
continue to be used, potentially resulting in the bypass of intended
security policies. The effect of PKI token revocation is also reversed
when the token expires, in the sense that a revoked token is once again
treated as being valid. Only setups using PKI tokens are affected.

Note:
The affected code was added to Keystone in the Folsom release, but was
moved to python-keystoneclient during the Grizzly development cycle.

python-keystoneclient fix (will be included in upcoming 0.2.4 release):
https://review.openstack.org/#/c/30742/

Keystone (Folsom) fix:
https://review.openstack.org/#/c/30743/

References:
https://bugs.launchpad.net/python-keystoneclient/+bug/1179615
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-2104

- -- 
Thierry Carrez (ttx)
OpenStack Vulnerability Management Team

Fix for openSUSE 12.3 submitted in sr#179261.

openSUSE-SU-2013:1089-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 821201,823783
CVE References: CVE-2013-2104,CVE-2013-2157
Sources used:
openSUSE 12.3 (src):    openstack-keystone-2012.2.4+git.1363796849.255b1d4-3.16.1, openstack-keystone-doc-2012.2.4+git.1363796849.255b1d4-3.16.1

so fixed