REDHAT-BUG-1004452
First published: Wed Sep 04 2013(Updated: )
Thierry Carrez reports: Title: Token revocation failure using Keystone memcache/KVS backends Reporter: Kieran Spear (University of Melbourne) Products: Keystone Affects: Folsom, Grizzly Description: Kieran Spear from the University of Melbourne reported a vulnerability in Keystone memcache and KVS token backends. The PKI token revocation lists stored the entire token instead of the token ID, triggering comparison failures, ultimately resulting in revoked PKI tokens still being considered valid. Only Folsom and Grizzly Keystone setups making use of PKI tokens with the memcache or KVS token backends are affected. Havana setups, setups using UUID tokens, or setups using PKI tokens with the SQL token backend are all unaffected.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Keystone | >=Folsom<=Grizzly |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=793753&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=793753&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=793754&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=793754&action=edit
- http://www.openwall.com/lists/oss-security/2013/09/11/5
- https://rhn.redhat.com/errata/RHSA-2013-1285.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1004452
Frequently Asked Questions
What is the severity of REDHAT-BUG-1004452?
The severity of REDHAT-BUG-1004452 is critical due to token revocation failure, posing significant security risks.
How do I fix REDHAT-BUG-1004452?
To fix REDHAT-BUG-1004452, upgrade your OpenStack Keystone installation to a version beyond Grizzly.
Which versions of Keystone are affected by REDHAT-BUG-1004452?
REDHAT-BUG-1004452 affects OpenStack Keystone versions from Folsom to Grizzly.
What products are impacted by REDHAT-BUG-1004452?
The impacted product by REDHAT-BUG-1004452 is OpenStack Keystone when using memcache or KVS backends.
Who reported the vulnerability REDHAT-BUG-1004452?
The vulnerability REDHAT-BUG-1004452 was reported by Kieran Spear from the University of Melbourne.
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-4294
- agent/references
- agent/last-modified-date
- agent/severity
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/openstack
- canonical/keystone