Bug 879402 (CVE-2012-5563)

Summary: CVE-2012-5563 OpenStack: Keystone extension of token validity through token chaining
Product: [Other] Security Response Reporter: Kurt Seifried <kseifried>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: apevec, markmc, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-12-11 07:57:50 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 879405    
Bug Blocks: 873487, 879404    
Attachments:
Description Flags
CVE-2012-5563-keystone.patch includes test case none

Description Kurt Seifried 2012-11-22 21:29:11 UTC
Thierry Carrez (thierry) of the OpenStack project reports:

Anndy reported a vulnerability in token chaining in Keystone. A token
expiration date can be circumvented by creating a new token before the
old one has expired. An authenticated and authorized user could
potentially leverage this vulnerability to extend his access beyond the
account owner expectations. Note: this vulnerability was fixed in the
past (CVE-2012-3426) but was reintroduced in Folsom when code was
refactored to support PKI tokens.

Comment 1 Kurt Seifried 2012-11-22 21:36:24 UTC
Created attachment 650039 [details]
CVE-2012-5563-keystone.patch includes test case

Comment 3 Murray McAllister 2012-12-10 05:46:54 UTC
Acknowledgements:

Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Anndy as the original reporter.

Comment 4 errata-xmlrpc 2012-12-10 21:02:19 UTC
This issue has been addressed in following products:

  OpenStack Folsom for RHEL 6

Via RHSA-2012:1557 https://rhn.redhat.com/errata/RHSA-2012-1557.html

Comment 5 Fedora Update System 2012-12-11 05:56:56 UTC
openstack-keystone-2012.2.1-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2012-12-19 18:33:55 UTC
openstack-keystone-2012.2.1-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.