Bugzilla – Bug 895847
VUL-0: CVE-2014-3621: openstack-keystone: Configuration option leak through Keystone catalog
Last modified: 2015-03-25 15:53:09 UTC
embargoed, via preannouncement CRD 2014-09-16, 1500UTC This is an advance warning of a vulnerability discovered in OpenStack, to give you, as downstream stakeholders, a chance to coordinate the release of fixes and reduce the vulnerability window. Please treat the following information as confidential until the proposed public disclosure date. Title: Configuration option leak through Keystone catalog Reporter: Brant Knudson (IBM) Products: Keystone Versions: up to 2013.2.3 and 2014.1 versions up to 2014.1.2.1 Description: Brant Knudson from IBM reported a vulnerability in Keystone catalog URL replacement. By creating a malicious endpoint a privileged user may reveal configuration options resulting in sensitive information, like master admin_token, being exposed through the service url. All Keystone setups that allow non-admin users to create endpoints are affected. Proposed patch: See attached patches. Unless a flaw is discovered in them, these patches will be merged to stable/havana, stable/icehouse and master (Juno development branch) on the public disclosure date. CVE: CVE-2014-3621 Proposed public disclosure date/time: 2014-09-16, 1500UTC Please do not make the issue public (or release public patches) before this coordinated embargo date. Regards, -- Tristan Cacqueray OpenStack Vulnerability Management Team
Created attachment 605603 [details] cve-2014-3621-master-juno.patch patch for Juno
Created attachment 605604 [details] cve-2014-3621-stable-havana.patch patch for havana
Created attachment 605605 [details] cve-2014-3621-stable-icehouse.patch patch for icehouse
bugbot adjusting priority
Affected packages: SLE-11-SP3-CL4: openstack-keystone SLE-11-SP3-PRODUCTS: openstack-keystone SLE-11-SP3-UPTU: openstack-keystone
not public, so nothing that we can do about it.
public via oss-sec now
It is already in our packages.
An update workflow for this issue was started. This issue was rated as low. Please submit fixed packages until 2014-10-24. https://swamp.suse.de/webswamp/wf/59124
SUSE-SU-2014:1365-1: An update that solves one vulnerability and has three fixes is now available. Category: security (low) Bug References: 895847,897467,897744,897815 CVE References: CVE-2014-3621 Sources used: SUSE Cloud 4 (src): openstack-keystone-2014.1.3.dev18.g878f12e-0.7.1, openstack-keystone-doc-2014.1.3.dev18.g878f12e-0.7.1
all updates released