Bug 1392282

Summary:	openstack-keystone: the token used to bootstrap keystone has a hard coded default value
Product:	[Other] Security Response	Reporter:	Tim Suter <tsuter>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	aortega, apevec, ayoung, chrisw, cvsbot-xmlrpc, jdennis, jschluet, kbasil, lhh, lpeer, markmc, nkinder, rbryant, sclewis, srevivo, tdecacqu
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-11-08 06:16:29 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:
Bug Blocks:	1327912

Description Tim Suter 2016-11-07 05:48:59 UTC

The shared token that is used to bootstrap keystone is a hardcoded value.

This only used as a fallback (default value in function signature)

This use case is not triggered when keystone is configured in any documented or supported configuration

for more information, see:
- https://bugs.launchpad.net/ossn/+bug/1545789 
- https://wiki.openstack.org/wiki/OSSN/OSSN-0064

Comment 1 Tim Suter 2016-11-07 23:18:54 UTC

Statement:

Red Hat Product Security has rated this issue as having Low security
impact.

In versions of openstack-keystone shipped with Red Hat Enterprise Linux OpenStack Platform 6, 7 and Red Hat OpenStack Platform 8 the condition required to create a vulnerable scenario was never met. While it is possible to create a vulnerable scenario, the level of access required to create the scenario exceeds that of the access obtained.

This issue did not affect versions of openstack-keystone shipped with Red Hat OpenStack Platform 9 and 10.

This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.