Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 513086 (CVE-2014-3476) - <sys-auth/keystone-{2013.2.3-r2,2014.1.1}: privilege escalation through trust chained delegation (CVE-2014-3476) (OSSA 2014-018)
Summary: <sys-auth/keystone-{2013.2.3-r2,2014.1.1}: privilege escalation through trust...
Alias: CVE-2014-3476
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
Whiteboard: ~1 [noglsa]
Depends on:
Reported: 2014-06-13 09:29 UTC by Agostino Sarubbo
Modified: 2014-06-16 02:36 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-06-13 09:29:54 UTC
From ${URL} :

OpenStack Security Advisory: 2014-018
CVE: CVE-2014-3476
Date: June 12, 2014
Title: Keystone privilege escalation through trust chained delegation
Reporter: Steven Hardy (Red Hat)
Products: Keystone
Versions: up to 2013.2.3, and 2014.1 to 2014.1.1

Steven Hardy from Red Hat reported a vulnerability in Keystone chained
delegation. By creating a delegation from a trust or OAuth token, a
trustee may abuse the identity impersonation against keystone and
circumvent the enforced scope, resulting in potential elevated
privileges to any of the trustor's projects and or roles. All Keystone
deployments configured to enable trusts are affected, which has been the
default since Grizzly.

Juno (development branch) fix:

Icehouse fix:

Havana fix:

This fix will be included in the Juno-2 development milestone and in
future 2013.2.4 and 2014.1.2 releases.


@maintainer(s): since the package or the affected version has never been marked as stable, we don't need to stabilize it. After the bump, please remove the affected versions from the tree.
Comment 1 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2014-06-15 16:59:10 UTC
fixed in the following


removing myself since I'm done here :D
Comment 2 Yury German Gentoo Infrastructure gentoo-dev 2014-06-16 02:36:34 UTC
Maintainer(s), Thank you for cleanup!

No GLSA needed as there are no stable versions.