oss-security - Re: [Openstack] [OSSA 2012-016] Token authorization for a user in a disabled tenant is allowed (CVE-2012-4457)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+KYVfiCkC_5SGN8BCLFfTmNovhkwQcPYvypBLXrFpQfVNmyjQ@mail.gmail.com>
Date: Fri, 28 Sep 2012 19:56:44 -0400
From: andi abes <andi.abes@...il.com>
To: Russell Bryant <rbryant@...hat.com>
Cc: "openstack@...ts.launchpad.net" <openstack@...ts.launchpad.net>, oss-security@...ts.openwall.com, 
	openstack-announce@...ts.openstack.org
Subject: Re: [Openstack] [OSSA 2012-016] Token authorization for a user in a
 disabled tenant is allowed (CVE-2012-4457)

is the plan going forward to announce these on friday afternoons?

On Fri, Sep 28, 2012 at 4:50 PM, Russell Bryant <rbryant@...hat.com> wrote:
> OpenStack Security Advisory: 2012-016
> CVE: CVE-2012-4457
> Date: September 28, 2012
> Title: Token authorization for a user in a disabled tenant is allowed
> Impact: High
> Reporter: Rohit Karajgi (NTT Data)
> Affects: Essex (prior to 2012.1.2), Folsom (prior to folsom-3
> development milestone)
>
> Description:
> Rohit Karajgi reported a vulnerability in Keystone. It was possible to
> get a token that is authorized for a disabled tenant. Once the token is
> established with authorization on the tenant, keystone would respond 200
> OK to token validation requests from other OpenStack services, allowing
> the user to work with the tenant's resources.
>
> Folsom fix: (Included in 2012.2)
> http://github.com/openstack/keystone/commit/4ebfdfaf23c6da8e3c182bf3ec2cb2b7132ef685
>
> Essex fix: (Included in 2012.1.2)
> http://github.com/openstack/keystone/commit/5373601bbdda10f879c08af1698852142b75f8d5
>
> References:
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-4457
> https://bugs.launchpad.net/keystone/+bug/988920
>
> --
> Russell Bryant
> OpenStack Vulnerability Management Team
>
> _______________________________________________
> Mailing list: https://launchpad.net/~openstack
> Post to     : openstack@...ts.launchpad.net
> Unsubscribe : https://launchpad.net/~openstack
> More help   : https://help.launchpad.net/ListHelp

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.