bugbot adjusting priority

Patch backported to Essex. The code changed slightly but the LDAP unit tests pass. sr#27267

Now public:

https://lists.launchpad.net/openstack/msg24372.html

Date: Thu, 13 Jun 2013 18:05:08 +0200
From: Thierry Carrez
Subject: [OSSA 2013-015] Authentication bypass when using LDAP backend (CVE-2013-2157)

OpenStack Security Advisory: 2013-015
CVE: CVE-2013-2157
Date: June 13, 2013
Title: Authentication bypass when using LDAP backend
Reporter: Jose Castro Leon (CERN)
Products: Keystone
Affects: Folsom, Grizzly

Description:
Jose Castro Leon from CERN reported a vulnerability in the way the
Keystone LDAP backend authenticates users. When provided with an empty
password, the backend would perform an anonymous LDAP bind that would
result in successfully authenticating the user. An attacker could
therefore easily impersonate and get valid tokens for any user. Only
Keystone setups using LDAP authentication backend are affected.

Havana (development branch) fix:
https://review.openstack.org/#/c/32896/

Grizzly fix:
https://review.openstack.org/#/c/32895/

Folsom fix:
https://review.openstack.org/#/c/32894/

References:
https://bugs.launchpad.net/keystone/+bug/1187305
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2157

The SWAMPID for this issue is 52997.
This issue was rated as moderate.
Please submit fixed packages until 2013-07-01.
When done, please reassign the bug to security-team@suse.de.
Patchinfo will be handled by security team.

Fix for openSUSE 12.3 submitted in sr#179261.

openSUSE-SU-2013:1089-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 821201,823783
CVE References: CVE-2013-2104,CVE-2013-2157
Sources used:
openSUSE 12.3 (src):    openstack-keystone-2012.2.4+git.1363796849.255b1d4-3.16.1, openstack-keystone-doc-2012.2.4+git.1363796849.255b1d4-3.16.1

Update released for: openstack-keystone, openstack-keystone-doc, openstack-keystone-test, python-keystone
Products:
SUSE-CLOUD 1.0 (x86_64)