CVE-2014-2237: Medium severity Openstack Keystone vulnerability
The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/keystoneto a version that resolves this vulnerability.Fixed in 8.0.0a0 - Upgrade
Upgrade
OpenStack Identity (Keystone) memcache token backend (trust tokens with impersonation enabled)to a version that resolves this vulnerability.Fixed in icehouse-3 - Compensating control
As a mitigation, disable trust token impersonation (i.e., do not issue trust tokens with impersonation enabled) until affected Keystone versions are upgraded/mitigated.
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2237?
CVE-2014-2237 is classified as a medium severity vulnerability.
How do I fix CVE-2014-2237?
To fix CVE-2014-2237, you should upgrade to Keystone version 8.0.0a0 or later.
What kind of impact does CVE-2014-2237 have on OpenStack Keystone?
CVE-2014-2237 allows unlisted trust tokens to be issued, which may lead to unauthorized access.
Which versions of OpenStack Keystone are affected by CVE-2014-2237?
CVE-2014-2237 affects OpenStack Keystone versions 2013.1 through 2013.2.2 and icehouse before icehouse-3.
Is CVE-2014-2237 a remote vulnerability?
CVE-2014-2237 can be exploited remotely if impersonation is enabled in the trust token configuration.