python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remote authenticated users to (1) retain use of a token after it has expired, or (2) use a revoked token once it expires.

This update of openstack-keystone fixes two security vulnerabilities.

  - Add CVE-2013-2104.patch: fix missing expiration check in     Keystone PKI token validation (CVE-2013-2104,     bnc#821201)

  - Add CVE-2013-2157.patch: fix authentication bypass when     using LDAP backend (CVE-2013-2157, bnc#823783)

Selective backports from stable/grizzly :

  - Ec2Signer: Initial support for v4 signature     verification.

    - Allow signature verification for older boto versions.

    - Default signing_dir to secure temp dir.

    - Fix memcache encryption middleware. (CVE-2013-2166,       CVE-2013-2167)

    - Check token expiry. (CVE-2013-2104)

    - Allow secure user password update. (CVE-2013-2013)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

authtoken: Check token expiry CVE-2013-2104 Force simple Bind for authentication CVE-2013-2157

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Eoghan Glynn and Alex Meade discovered that Keystone did not properly perform expiry checks for the PKI tokens used in Keystone. If Keystone were setup to use PKI tokens, a previously authenticated user could continue to use a PKI token for longer than intended. This issue only affected Ubuntu 12.10 which does not use PKI tokens by default.
(CVE-2013-2104)

Jose Castro Leon discovered that Keystone did not properly authenticate users when using the LDAP backend. An attacker could obtain valid tokens and impersonate other users by supplying an empty password. By default, Ubuntu does not use the LDAP backend.
(CVE-2013-2157).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Eoghan Glynn and Alex Meade discovered that python-keystoneclient did not properly perform expiry checks for the PKI tokens used in Keystone. If Keystone were setup to use PKI tokens (the default in Ubuntu 13.04), a previously authenticated user could continue to use a PKI token for longer than intended.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75063	openSUSE Security Update : openstack-keystone (openSUSE-SU-2013:1089-1)	Nessus	SuSE Local Security Checks	medium
69361	Fedora 19 : python-keystoneclient-0.2.3-7.fc19 (2013-14302)	Nessus	Fedora Local Security Checks	medium
69288	Fedora 18 : openstack-keystone-2012.2.4-5.fc18 (2013-10713)	Nessus	Fedora Local Security Checks	medium
66893	Ubuntu 12.10 / 13.04 : keystone vulnerabilities (USN-1875-1)	Nessus	Ubuntu Local Security Checks	medium
66783	Ubuntu 13.04 : python-keystoneclient vulnerability (USN-1851-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2013-2104

medium

Tenable Plugins

medium

medium

medium

medium

medium