OSSA-2014-007: Potential context confusion in Keystone middleware¶
- Date:
March 27, 2014
- CVE:
CVE-2014-0105
Affects¶
Python-keystoneclient: All versions up to 0.6.0
Description¶
Kieran Spear from the University of Melbourne reported a vulnerability in Keystone auth_token middleware (shipped in python-keystoneclient). By doing repeated requests, with sufficient load on the target system, an authenticated user may in certain situations assume another authenticated user’s complete identity and multi-tenant authorizations, potentially resulting in a privilege escalation. Note that it is related to a bad interaction between eventlet and python-memcached that should be avoided if the calling process already monkey-patches “thread” to use eventlet. Only keystone middleware setups using auth_token with memcache are vulnerable.
Patches¶
https://review.openstack.org/#/c/81078 (Python-keystoneclient-0.7.0)
Credits¶
Kieran Spear from University of Melbourne (CVE-2014-0105)
