Bug 885798 (CVE-2014-3520) - VUL-0: CVE-2014-3520: openstack-keystone: Keystone V2 trusts privilege escalation through user
Summary: VUL-0: CVE-2014-3520: openstack-keystone: Keystone V2 trusts privilege escala...
Status: RESOLVED FIXED
Alias: CVE-2014-3520
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2014-07-21
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/103218/
Whiteboard: maint:released:sle11-sp3-uptu:58300 m...
Keywords:
Depends on:
Blocks:
 
Reported: 2014-07-04 06:42 UTC by Victor Pereira
Modified: 2015-07-22 07:25 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2014-07-04 06:42:02 UTC
CVE-2014-352

Title: Keystone V2 trusts privilege escalation through user supplied project id
Reporter: Jamie Lennox (Red Hat)
Products: Keystone
Versions: up to 2013.2.3, and 2014.1 to 2014.1.1

Description:
Jamie Lennox from Red Hat reported a vulnerability in Keystone trusts.
By using an out of scope project id, a trustee may gain unauthorized
access if the trustor has the required roles in the requested project
id. All Keystone deployments configured to enable trusts and V2 API are
affected.

References:
http://openwall.com/lists/oss-security/2014/07/02/7
https://bugs.launchpad.net/keystone/+bug/1331912
https://bugzilla.redhat.com/show_bug.cgi?id=1112668
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3520
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-3520.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3520
Comment 1 Bernhard Wiedemann 2014-07-04 07:36:42 UTC
https://review.openstack.org/#/q/I00ad783bcb93cea9e5622965f81b91c80f4570cc,n,z

is in our packages now
Comment 2 Swamp Workflow Management 2014-07-04 22:00:11 UTC
bugbot adjusting priority
Comment 3 Bernhard Wiedemann 2014-07-07 09:33:53 UTC
submitted
https://build.suse.de/request/show/40779 Cloud3 / openstack-keystone
Comment 4 Swamp Workflow Management 2014-07-07 11:03:26 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2014-07-21.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/58188
Comment 5 SMASH SMASH 2014-07-07 11:05:12 UTC
Affected packages:

SLE-11-SP2-PRODUCTS: openstack-keystone
SLE-11-SP3: openstack-keystone
SLE-11-SP3-CLOUD4: openstack-keystone
SLE-11-SP3-PRODUCTS: openstack-keystone
SLE-11-SP3-UPTU: openstack-keystone
Comment 6 Swamp Workflow Management 2014-08-11 17:04:25 UTC
SUSE-SU-2014:0988-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 885798
CVE References: CVE-2014-3520
Sources used:
SUSE Cloud 3 (src):    openstack-keystone-2013.2.4.dev6.g96d9bcf-0.7.1, openstack-keystone-doc-2013.2.4.dev6.g96d9bcf-0.7.1
Comment 7 Alexander Bergmann 2014-08-19 08:19:01 UTC
Fix was released. Closing bug.
Comment 8 Victor Pereira 2015-07-22 07:25:55 UTC
fixed and released