CVE-2014-0105: Medium severity Openstack python-keystoneclient vulnerability
A context confusion vulnerability was identified in Keystone authtoken middleware (shipped in python-keystoneclient) before 0.7.0. By doing repeated requests, with sufficient load on the target system, an authenticated user may in certain situations assume another authenticated user's complete identity and multi-tenant authorizations, potentially resulting in a privilege escalation. Note that it is related to a bad interaction between eventlet and python-memcached that should be avoided if the calling process already monkey-patches "thread" to use eventlet. Only keystone middleware setups using authtoken with memcache are vulnerable.
Other sources
The authtoken middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/python-keystoneclientto a version that resolves this vulnerability.Fixed in 0.7.0 - Upgrade
Upgrade
python-keystoneclient/auth_token middleware (Keystone)to a version that resolves this vulnerability.Fixed in 0.7.0 - Configuration
Avoid the vulnerable bad interaction between eventlet and python-memcached by ensuring the calling process monkey-patches "thread" to use eventlet before the auth_token middleware (auth_token with memcache).
OpenStack Keystone auth_token middleware using memcache eventlet monkey-patching of thread = Ensure the calling process already monkey-patches "thread" to use eventlet - Compensating control
For keystone middleware setups, avoid using auth_token middleware with memcache if you cannot ensure the calling process already monkey-patches "thread" to use eventlet; only setups using auth_token with memcache are vulnerable.
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0105?
CVE-2014-0105 is considered to be a moderate severity vulnerability due to its potential for user impersonation under specific conditions.
How do I fix CVE-2014-0105?
To fix CVE-2014-0105, upgrade the python-keystoneclient to version 0.7.0 or later immediately.
Which versions of python-keystoneclient are affected by CVE-2014-0105?
Versions of python-keystoneclient before 0.7.0, specifically up to 0.6.0, are affected by CVE-2014-0105.
Who is impacted by CVE-2014-0105?
Users of the affected python-keystoneclient versions may be impacted, particularly in environments with high request loads.
What kind of vulnerability is CVE-2014-0105?
CVE-2014-0105 is a context confusion vulnerability that allows authenticated users to potentially assume other users' identities.