Bug 1085933

Summary: Replace python-oauth2 with oauthlib
Product: Red Hat OpenStack Reporter: Nathan Kinder <nkinder>
Component: openstack-keystoneAssignee: Alan Pevec <apevec>
Status: CLOSED ERRATA QA Contact: Udi Kalifon <ukalifon>
Severity: high Docs Contact:
Priority: high    
Version: 4.0CC: apevec, ayoung, nkinder, sclewis, yeylon
Target Milestone: z4Keywords: ZStream
Target Release: 4.0Flags: nkinder: internal-review+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: openstack-keystone-2013.2.3-3.el6ost Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-05-29 20:34:26 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1085944    
Bug Blocks:    

Description Nathan Kinder 2014-04-09 16:41:48 UTC
Keystone in RHEL OSP 4.0 uses python-oauth2, which is unmaintained and has security issues (CVE-2013-4346 and CVE-2013-4347).  Upstream has switched to using oauthlib instead as of Icehouse.  We should backport the changes for this and drop the python-oauth2 package.

Comment 1 Nathan Kinder 2014-04-09 16:45:21 UTC
Backport request for stable/havana (denied upstream): 

  https://review.openstack.org/#/c/70750/

Review/commit for Icehouse:

  https://review.openstack.org/64427
  https://git.openstack.org/cgit/openstack/keystone/commit/?id=bed88a2e724f5f23a1c839b7872b1bc56f059df5

Comment 6 Udi Kalifon 2014-04-22 14:10:56 UTC
Verified that oauth2 is not being used anywhere in the code, and only oauthlib is imported. No use case was tested.

python-keystone-2013.2.3-3.el6ost.noarch

Comment 9 errata-xmlrpc 2014-05-29 20:34:26 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2014-0580.html