Bugzilla – Bug 870102
VUL-0: CVE-2014-0105: python-keystoneclient: Potential context confusion in Keystone middleware
Last modified: 2014-07-02 09:21:58 UTC
EMBARGOED until 2014-03-27 15:00 UTC from openstack, via distros, This is an advance warning of a vulnerability discovered in OpenStack, to give you, as downstream stakeholders, a chance to coordinate the release of fixes and reduce the vulnerability window. Please treat the following information as confidential until the proposed public disclosure date. Title: Potential context confusion in Keystone middleware Reporter: Kieran Spear (University of Melbourne) Products: python-keystoneclient Versions: All versions up to 0.6.0 Description: Kieran Spear from the University of Melbourne reported a vulnerability in Keystone auth_token middleware (shipped in python-keystoneclient). By doing repeated requests, with sufficient load on the target system, an authenticated user may in certain situations assume another authenticated user's complete identity and multi-tenant authorizations, potentially resulting in a privilege escalation. Note that it is related to a bad interaction between eventlet and python-memcached that should be avoided if the calling process already monkey-patches "thread" to use eventlet. Only keystone middleware setups using auth_token with memcache are vulnerable. Proposed patch: See attached patch. This patch has already been merged to the master branch of python-keystoneclient and will be included in the 0.7.0 release. CVE: CVE-2014-0105 Proposed public disclosure date/time: 2014-03-27 15:00 UTC Please do not make the issue public (or release public patches) before this coordinated embargo date. Regards, -- Tristan Cacqueray OpenStack Vulnerability Management Team
Created attachment 583538 [details] cve-2014-0105-master-0.7.0.patch patch attached to email
bugbot adjusting priority
public now
In SUSE Cloud we always use driver = keystone.token.backends.sql.Token so if this really only affects keystone-memcache setups, we should not be affected.
Fix is in master: https://review.openstack.org/#q,Iffb1d1bff5dc4437544a5aefef3bca0e5b17cc81,n,z
just mark upstream fixed