Detections
Analytics
RHEL 6 : python-keystoneclient (RHSA-2014:0382)
low Nessus Plugin ID 234405
Language:
Synopsis
The remote Red Hat host is missing a security update for python-keystoneclient.Description
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:0382 advisory.Python-keystoneclient is a client library and a command line utility for interacting with the OpenStack Identity API. The OpenStack Identity auth_token middleware component handles the authentication of tokens with keystone.
When using the auth_token middleware with the memcached token cache enabled, a token for a different identity could be returned. An authenticated user could use this flaw to escalate their privileges by making repeated requests that could eventually allow the user to acquire the administrator's identity. Note that only OpenStack Identity setups using auth_token with memcached were affected. (CVE-2014-0105)
Red Hat would like to thank the OpenStack project for reporting this issue.
Upstream acknowledges Kieran Spear from the University of Melbourne as the original reporter.
The python-keystoneclient package has been upgraded to version 0.7.1.
Additionally, the python-six package has been upgraded to version 1.5.2, required by the updated python-keystoneclient package.
All python-keystoneclient users are advised to upgrade to these updated packages, which correct this issue. After installing this update, all OpenStack services using auth_token must be restarted for this update to take effect.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Update the RHEL python-keystoneclient package based on the guidance in RHSA-2014:0382.See Also
https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=1082165
Plugin Details
Severity: Low
ID: 234405
File Name: redhat-RHSA-2014-0382.nasl
Version: 1.1
Type: local
Agent: unix
Family: Red Hat Local Security Checks
Published: 4/15/2025
Updated: 4/15/2025
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.0
Vendor
Vendor Severity: Important
CVSS v2
Risk Factor: Medium
Base Score: 6
Temporal Score: 4.4
Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSS Score Source: CVE-2014-0105
CVSS v3
Risk Factor: Medium
Base Score: 6
Temporal Score: 5.2
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Low
Base Score: 2.3
Threat Score: 0.6
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L
Vulnerability Information
CPE: p-cpe:/a:redhat:enterprise_linux:python-six, cpe:/o:redhat:enterprise_linux:6, p-cpe:/a:redhat:enterprise_linux:python-keystoneclient-doc, p-cpe:/a:redhat:enterprise_linux:python-keystoneclient
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
Exploit Ease: No known exploits are available
Patch Publication Date: 4/9/2014
Vulnerability Publication Date: 2/21/2014
Reference Information
CVE: CVE-2014-0105
RHSA: 2014:0382