CVE-2013-2030: Medium severity openstack compute (nova) vulnerability

Originally reported by Grant Murphy (gmurphy):

The signing directory is used to store the signing certificates and the default location for this directory is:

signingdir = /tmp/keystone-signing-nova

In the file:

keystone/middleware/authtoken.py

During the initialization of the AuthMiddleware the following operations are made for the signing directory:

IF the directory exists but cannot be written to a configuration error is raised. ELSE IF the directory doesn't exist, create it. NEXT chmod permisions(stat.SIRWXU) to the signingdirectory

AFAICT The signing certificates used in validation will only be fetched from the keystone if the cmsverify action raises an exception because the certificate file is missing from the signing directory.

This means that if an attacker populated the /tmp/keystone-signing-nova with the appropriate files for signautre verification they could potentially issue forged tokens which would be validated by the middleware. As: - The directory location deterministic. (default for glance, nova) - If the directory already exists it is reused

— Red Hat