Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 503446 (CVE-2014-2237) - <sys-auth/keystone-{2013.1.4-r3,2013.2.2-r1}: Trustee token revocation does not work with memcache backend (CVE-2014-2237) [OSSA 2014-006]
Summary: <sys-auth/keystone-{2013.1.4-r3,2013.2.2-r1}: Trustee token revocation does n...
Alias: CVE-2014-2237
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
Whiteboard: ~4 [noglsa]
Depends on:
Reported: 2014-03-04 20:05 UTC by Agostino Sarubbo
Modified: 2014-10-13 20:28 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-03-04 20:05:08 UTC
From ${URL} :

OpenStack Security Advisory: 2014-006
CVE: CVE-2014-2237
Date: March 04, 2014
Title: Trustee token revocation does not work with memcache backend
Reporter: Morgan Fainberg (Metacloud)
Products: Keystone
Versions: 2013.1 up to 2013.1.4 and 2013.2 versions up to 2013.2.2

Morgan Fainberg from Metacloud reported a vulnerability in the Keystone
memcache token backend. When a trustor issues a trust token with
impersonation enabled, the token is only added to the trustor's token
list and not to the trustee's token list. This results in the trust
token not being invalidated by the trustee's token revocation (bulk
revocation). This is most noticeable when the trustee user is disabled
or the trustee changes a password. Only setups using the memcache
backend for tokens in Keystone are affected.

Icehouse (development branch) fix:

Havana fix:

Grizzly fix:

This fix will be included in the icehouse-3 development milestone and in
future 2013.1.5 and 2013.2.3 releases.


@maintainer(s): since the package has never been marked as stable, we don't need to stabilize it. After the bump, please remove the affected versions from the tree.
Comment 1 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2014-03-16 19:54:49 UTC
fixed in 2013.1.4-r3 and 2013.2.2-r1

removing from cc
Comment 2 Yury German Gentoo Infrastructure gentoo-dev 2014-03-20 21:16:34 UTC
Maintainer(s) and Arches, Thank you for your work.

No Stable version, no GLSA required