yahoo-eng-team team mailing list archive

[Thierry Carrez <thierry.carrez+lp@xxxxxxxxx>]

** Changed in: keystone
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1383817

Title:
  Deprecate catalog replacements and whitelists

Status in OpenStack Identity (Keystone):
  Fix Released

Bug description:
  Bug #1354208 reported a security flaw in the way that we performed
  substitution for catalog URLs. The immediate solution was to add a
  whitelist of config fields that are safe to use with substitution. The
  long term goal is to get rid of this feature and only allow tenant_id
  and user_id to be used for substitution.

  The first step for the Kilo release is to deprecate the feature.

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1383817/+subscriptions