Re: Re: [Openstack] [OSSA 2012-016] Token authorization for a user in a disabled tenant is allowed (CVE-2012-4457)

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/28/2012 05:56 PM, andi abes wrote:
> is the plan going forward to announce these on friday afternoons?

I can't speak for OpenStack but the history of these vulns is that
they have been public since May 2012 and April 2012, but were not
labelled as security, they were noticed, CVE's were assigned and I
think the idea was to notify people quickly since they're have a
significant impact and have been around for a while.

> On Fri, Sep 28, 2012 at 4:50 PM, Russell Bryant
> <rbryant () redhat com> wrote:
> > OpenStack Security Advisory: 2012-016 CVE: CVE-2012-4457 Date:
> > September 28, 2012 Title: Token authorization for a user in a
> > disabled tenant is allowed Impact: High Reporter: Rohit Karajgi
> > (NTT Data) Affects: Essex (prior to 2012.1.2), Folsom (prior to
> > folsom-3 development milestone)
> >
> > Description: Rohit Karajgi reported a vulnerability in Keystone.
> > It was possible to get a token that is authorized for a disabled
> > tenant. Once the token is established with authorization on the
> > tenant, keystone would respond 200 OK to token validation
> > requests from other OpenStack services, allowing the user to work
> > with the tenant's resources.
> >
> > Folsom fix: (Included in 2012.2) 
> > http://github.com/openstack/keystone/commit/4ebfdfaf23c6da8e3c182bf3ec2cb2b7132ef685
Essex fix: (Included in 2012.1.2)
> > http://github.com/openstack/keystone/commit/5373601bbdda10f879c08af1698852142b75f8d5
References:
> > http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-4457 
> > https://bugs.launchpad.net/keystone/+bug/988920
> >
> > -- Russell Bryant OpenStack Vulnerability Management Team
> >
> > _______________________________________________ Mailing list:
> > https://launchpad.net/~openstack Post to     :
> > openstack () lists launchpad net Unsubscribe :
> > https://launchpad.net/~openstack More help   :
> > https://help.launchpad.net/ListHelp


- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/

iQIcBAEBAgAGBQJQZpKqAAoJEBYNRVNeJnmTUqMP/02lnwb+9O/efN51/Y2qkNzz
nNSXKWl1ht1beuQaRiLqkRm3au81gtKewO/TmbJHN++6EI54vT1EUj0IXZlXm+aV
fsdp9rQrJGILMUVPydOccHOe54nhLKUZ/F9os5PmAHhuZJHqSo5oDU2TbiYQeeX+
vLVJrBG1GXIOxsXWXTV4Bp11+D6mwYIgVQUVN3pk/ZzKeEk9S6T71NHXj1RDZMpZ
i6Cs35r6nRDcxOsj65jJysiWrHEahjau8bmdZ3KW/2FdjHuzvdqRz3/doFrmAiCG
bQ4I7laagNC8XkOIZ7UV1S5pTYB64iSvGv+haW7Lq9mjWjrZ6wX06R7J/NX5wDPC
A3RAIKxYLzkJdn0ifx922lfJkK7SH01dSDWpSib0KQzkkvQBw/6QcSah3TwBpDka
kFA9ifMYWhiBhn9OFTcIpAT8mpdhmLBiALZsvxM0lRLxCqslcoExK1gWLhyL1tSf
b2ENNYYZuNNSZMFCp/zm2giZZV2XpUxvPIcyuEGd8RLKANhVI2o+TOKoCmbpBZsE
9RA5W8zkYxmheVxGLLcPMs02uqK1ZCFh4dKYRDWEXMFTZinyHQahjPY9tUBEPk+b
am5I5FB4NelhVoLmiTwI9+nIV0VINJj7/UiCD7bGqU8UENcAGzjl3az9fJp6iM6I
FFxytD+xS5uN7uwomVyD
=3hBF
-----END PGP SIGNATURE-----