[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <506692AA.5040206@redhat.com>
Date: Sat, 29 Sep 2012 00:18:18 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: andi abes <andi.abes@...il.com>, Russell Bryant <rbryant@...hat.com>
Subject: Re: Re: [Openstack] [OSSA 2012-016] Token authorization
for a user in a disabled tenant is allowed (CVE-2012-4457)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 09/28/2012 05:56 PM, andi abes wrote:
> is the plan going forward to announce these on friday afternoons?
I can't speak for OpenStack but the history of these vulns is that
they have been public since May 2012 and April 2012, but were not
labelled as security, they were noticed, CVE's were assigned and I
think the idea was to notify people quickly since they're have a
significant impact and have been around for a while.
> On Fri, Sep 28, 2012 at 4:50 PM, Russell Bryant
> <rbryant@...hat.com> wrote:
>> OpenStack Security Advisory: 2012-016 CVE: CVE-2012-4457 Date:
>> September 28, 2012 Title: Token authorization for a user in a
>> disabled tenant is allowed Impact: High Reporter: Rohit Karajgi
>> (NTT Data) Affects: Essex (prior to 2012.1.2), Folsom (prior to
>> folsom-3 development milestone)
>>
>> Description: Rohit Karajgi reported a vulnerability in Keystone.
>> It was possible to get a token that is authorized for a disabled
>> tenant. Once the token is established with authorization on the
>> tenant, keystone would respond 200 OK to token validation
>> requests from other OpenStack services, allowing the user to work
>> with the tenant's resources.
>>
>> Folsom fix: (Included in 2012.2)
>> http://github.com/openstack/keystone/commit/4ebfdfaf23c6da8e3c182bf3ec2cb2b7132ef685
>>
>>
>>
Essex fix: (Included in 2012.1.2)
>> http://github.com/openstack/keystone/commit/5373601bbdda10f879c08af1698852142b75f8d5
>>
>>
>>
References:
>> http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-4457
>> https://bugs.launchpad.net/keystone/+bug/988920
>>
>> -- Russell Bryant OpenStack Vulnerability Management Team
>>
>> _______________________________________________ Mailing list:
>> https://launchpad.net/~openstack Post to :
>> openstack@...ts.launchpad.net Unsubscribe :
>> https://launchpad.net/~openstack More help :
>> https://help.launchpad.net/ListHelp
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iQIcBAEBAgAGBQJQZpKqAAoJEBYNRVNeJnmTUqMP/02lnwb+9O/efN51/Y2qkNzz
nNSXKWl1ht1beuQaRiLqkRm3au81gtKewO/TmbJHN++6EI54vT1EUj0IXZlXm+aV
fsdp9rQrJGILMUVPydOccHOe54nhLKUZ/F9os5PmAHhuZJHqSo5oDU2TbiYQeeX+
vLVJrBG1GXIOxsXWXTV4Bp11+D6mwYIgVQUVN3pk/ZzKeEk9S6T71NHXj1RDZMpZ
i6Cs35r6nRDcxOsj65jJysiWrHEahjau8bmdZ3KW/2FdjHuzvdqRz3/doFrmAiCG
bQ4I7laagNC8XkOIZ7UV1S5pTYB64iSvGv+haW7Lq9mjWjrZ6wX06R7J/NX5wDPC
A3RAIKxYLzkJdn0ifx922lfJkK7SH01dSDWpSib0KQzkkvQBw/6QcSah3TwBpDka
kFA9ifMYWhiBhn9OFTcIpAT8mpdhmLBiALZsvxM0lRLxCqslcoExK1gWLhyL1tSf
b2ENNYYZuNNSZMFCp/zm2giZZV2XpUxvPIcyuEGd8RLKANhVI2o+TOKoCmbpBZsE
9RA5W8zkYxmheVxGLLcPMs02uqK1ZCFh4dKYRDWEXMFTZinyHQahjPY9tUBEPk+b
am5I5FB4NelhVoLmiTwI9+nIV0VINJj7/UiCD7bGqU8UENcAGzjl3az9fJp6iM6I
FFxytD+xS5uN7uwomVyD
=3hBF
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
