openstack team mailing list archive

[Thierry Carrez <thierry@xxxxxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

OpenStack Security Advisory: 2013-017
CVE: CVE-2013-2166, CVE-2013-2167
Date: June 19, 2013
Title: Issues in Keystone middleware memcache signing/encryption feature
Reporter: Paul McMillan (Nebula)
Products: python-keystoneclient
Affects: version 0.2.3 to 0.2.5

Description:
Paul McMillan from Nebula reported multiple issues in the implementation
of memcache signing/encryption feature in Keystone client middleware. An
attacker with direct write access to the memcache backend (or in a
man-in-the-middle position) could insert malicious data and potentially
bypass the encryption (CVE-2013-2166) or signing (CVE-2013-2167)
security strategy that was specified. Only setups that make use of
memcache caching in the Keystone middleware (specify memcache_servers)
and using ENCRYPT or MAC as their memcache_security_strategy are affected.

python-keystoneclient fix (will be included in upcoming 0.2.6 release):
https://review.openstack.org/#/c/33661

References:
https://bugs.launchpad.net/python-keystoneclient/+bug/1175367
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2166
https://bugs.launchpad.net/python-keystoneclient/+bug/1175368
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2167

- -- 
Thierry Carrez (ttx)
OpenStack Vulnerability Management Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with undefined - http://www.enigmail.net/

iQIcBAEBCAAGBQJRwdC5AAoJEFB6+JAlsQQjOTQP/1q8R6aPU9RcbsZ5pRm4YU7L
gp1XHpoCKmAAFhPjVbjOXLfW0xAfa0B+ATG/BeM4dvysgnQIRb21D4vu4wqCyLq/
Mw6pvytEyd5hGWpSY5eG6cQJ+UrACRDRgjMDIrR6PkwfWK0wW1p+2XzbzH9WIO7F
u4/oneUOSlN04wLd1qx0hy2mybFGUu8rPsJyaPJq2qivhGOwIOq85WddurtK1wXl
aTdYnavJxmUsTLFHjlpveKaEmlGrYNxeAMTpkZiSANPxU9rcjZNNEmgdGriV1Cdp
U3A08z+s7UiZT10cXg3y3C3pNV+upiS5b939fvrSCdJcMmSUBDZ9Bz9zpMYZ/EZm
gJLBe2HskHmOfUzdgmVla2HLKqex/no4aLqbVBLkpFhkesKWz+2mTjvTAygjL5vg
Ps8viGv80b1DwSUoyI22VChDkXmarkfOFbIdl7yu3h6LDXOSUawA1OiELjlSHyB4
AM1Vl3bSYT9MSHvwymSd4ML/nH01nE0COb1kLzWEqDyFUfq6NjyCOkb74rgrjLH5
E1LVG/4DyYtQ0unOtIT2wyYqEUINAV/qv/GwkhMqroGbPle63+OLRaDtVSciiEdj
z/ljz6eMGEeD/cHi80yhsKGo0HjmXzG3X83Y6cSaqWbXUvIw0kbidLwX4fzlnGr0
JCWckqbCAwwKyRNAADVb
=1zJ2
-----END PGP SIGNATURE-----