Bugzilla – Bug 866483
VUL-1: CVE-2014-2237: openstack-keystone: trustee token revocation does not work with memcache backend
Last modified: 2014-09-01 11:56:47 UTC
via oss-security A vulnerability was discovered in OpenStack (see below). In order to ensure full traceability, we need a CVE number assigned that we can attach to further notifications. This issue is already public, although an advisory was not sent yet. Title: Trustee token revocation does not work with memcache backend Reporter: Morgan Fainberg (Metacloud) Products: Keystone Versions: 2013.1 up to 2013.1.4 and 2013.2 versions up to 2013.2.2 Description: Morgan Fainberg from Metacloud reported a vulnerability in the Keystone memcache token backend. When a trustor issues a trust token with impersonation enabled, the token is only added to the trustor's token list and not to the trustee's token list. This results in the trust token not being invalidated by the trustee's token revocation (bulk revocation). This is most noticeable when the trustee user is disabled or the trustee changes a password. Only setups using the memcache backend for tokens in Keystone are affected. References: https://launchpad.net/bugs/1260080 References: https://bugzilla.redhat.com/show_bug.cgi?id=1071434
bugbot adjusting priority
is our setup affected even?
I don't think we're using the memcache backend; I think we're using the database one, so possibly not. Leaving it up to Sascha who can likely confirm.
The SWAMPID for this issue is 56805. This issue was rated as moderate. Please submit fixed packages until 2014-04-09. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
Affected packages: SLE-11-SP3-PRODUCTS: openstack-keystone
we always use driver = keystone.token.backends.sql.Token so this issue should not affect us and we can just add this patch with the next normal update
https://build.suse.de/request/show/35310 openstack-keystone might need updated crowbar-barclamp-keystone
The SWAMPID for this issue is 56887. This issue was rated as moderate. Please submit fixed packages until 2014-04-17. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
Update released for: openstack-keystone, openstack-keystone-test, python-keystone Products: SUSE-CLOUD 3.0 (x86_64)
SUSE-SU-2014:0519-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 866483,869326 CVE References: CVE-2014-2237 Sources used: SUSE Cloud 3 (src): openstack-keystone-2013.2.3.dev4.g27e1469-0.7.1
released