| Summary: | <sys-auth/keystone-{2013.1.4-r3,2013.2.2-r1}: Trustee token revocation does not work with memcache backend (CVE-2014-2237) [OSSA 2014-006] | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | trivial | ||
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://www.openwall.com/lists/oss-security/2014/03/04/16 | ||
| Whiteboard: | ~4 [noglsa] | ||
| Package list: | Runtime testing required: | --- | |
fixed in 2013.1.4-r3 and 2013.2.2-r1 removing from cc Maintainer(s) and Arches, Thank you for your work. No Stable version, no GLSA required Closing. |
From ${URL} : OpenStack Security Advisory: 2014-006 CVE: CVE-2014-2237 Date: March 04, 2014 Title: Trustee token revocation does not work with memcache backend Reporter: Morgan Fainberg (Metacloud) Products: Keystone Versions: 2013.1 up to 2013.1.4 and 2013.2 versions up to 2013.2.2 Description: Morgan Fainberg from Metacloud reported a vulnerability in the Keystone memcache token backend. When a trustor issues a trust token with impersonation enabled, the token is only added to the trustor's token list and not to the trustee's token list. This results in the trust token not being invalidated by the trustee's token revocation (bulk revocation). This is most noticeable when the trustee user is disabled or the trustee changes a password. Only setups using the memcache backend for tokens in Keystone are affected. Icehouse (development branch) fix: https://review.openstack.org/60743 Havana fix: https://review.openstack.org/75521 Grizzly fix: https://review.openstack.org/75526 Notes: This fix will be included in the icehouse-3 development milestone and in future 2013.1.5 and 2013.2.3 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2237 https://launchpad.net/bugs/1260080 @maintainer(s): since the package has never been marked as stable, we don't need to stabilize it. After the bump, please remove the affected versions from the tree.