[<prev] [next>] [day] [month] [year] [list]
Message-ID: <5315FEA9.4040400@enovance.com>
Date: Tue, 04 Mar 2014 17:26:17 +0100
From: Tristan Cacqueray <tristan.cacqueray@...vance.com>
To: oss-security@...ts.openwall.com
Subject: [OSSA 2014-006] Trustee token revocation does not work with memcache
backend (CVE-2014-2237)
OpenStack Security Advisory: 2014-006
CVE: CVE-2014-2237
Date: March 04, 2014
Title: Trustee token revocation does not work with memcache backend
Reporter: Morgan Fainberg (Metacloud)
Products: Keystone
Versions: 2013.1 up to 2013.1.4 and 2013.2 versions up to 2013.2.2
Description:
Morgan Fainberg from Metacloud reported a vulnerability in the Keystone
memcache token backend. When a trustor issues a trust token with
impersonation enabled, the token is only added to the trustor's token
list and not to the trustee's token list. This results in the trust
token not being invalidated by the trustee's token revocation (bulk
revocation). This is most noticeable when the trustee user is disabled
or the trustee changes a password. Only setups using the memcache
backend for tokens in Keystone are affected.
Icehouse (development branch) fix:
https://review.openstack.org/60743
Havana fix:
https://review.openstack.org/75521
Grizzly fix:
https://review.openstack.org/75526
Notes:
This fix will be included in the icehouse-3 development milestone and in
future 2013.1.5 and 2013.2.3 releases.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2237
https://launchpad.net/bugs/1260080
--
Tristan Cacqueray
OpenStack Vulnerability Management Team
Download attachment "signature.asc" of type "application/pgp-signature" (556 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
