Bug 958756 (CVE-2015-7546) - VUL-0: CVE-2015-7546: openstack-keystone: Potential reuse of revoked Identity tokens
Summary: VUL-0: CVE-2015-7546: openstack-keystone: Potential reuse of revoked Identity...
Status: RESOLVED FIXED
Alias: CVE-2015-7546
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: CVSSv2:SUSE:CVE-2015-7546:5.4:(AV:A/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-12-11 11:57 UTC by Marcus Meissner
Modified: 2016-05-31 16:21 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
reproducer.txt (1.21 KB, text/plain)
2015-12-16 12:09 UTC, Marcus Meissner 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Swamp Workflow Management 2015-12-11 23:00:24 UTC 
bugbot adjusting priority
Comment 5 Marcus Meissner 2015-12-16 12:08:24 UTC 
https://bugs.launchpad.net/keystone/+bug/1490804

A keystone token which has been revoked can still be used by manipulating particular byte fields within the token.
When a Keystone token is revoked it is added to the revoked list which stores the exact token value. Any API will look at the token to see whether or not it should accept a token. By changing a single byte within the token, the revocation can be bypassed. see the testing script [1].

It is suggested that the revocation should be changed to only check the token's inner ID.

[1] http://paste.openstack.org/show/436516/
Comment 6 Marcus Meissner 2015-12-16 12:09:11 UTC 
Created attachment 659544 [details]
reproducer.txt

paste.openstack.org content from above comment
Comment 7 Marcus Meissner 2015-12-18 13:12:11 UTC 
This looks like something to document for cloud 5.

Can you write up a small piece of text we could publish?
Comment 8 Dirk Mueller 2015-12-18 13:57:08 UTC 
https://wiki.openstack.org/wiki/OSSN/OSSN-0062

The setting in crowbar is in the Keystone barclamp and is called
"Algorithm for Token Generation". This one defaults to PKI and it should be changed to UUID.
Comment 9 Marcus Meissner 2015-12-18 14:05:55 UTC 
bin/addnote CVE-2015-7546 "SUSE OpenStack Cloud 5 is affected by this problem, but we can not change this per update. The Administrator can apply a change to fix this security problem in the Keystone Barclamp, 'Algorithm for Token Generation'. Please refer to the <a href=\"https://wiki.openstack.org/wiki/OSSN/OSSN-0062\">OpenStack Security Notice</a> for the details."