Thierry Carrez reports: Title: Keystone tokens not immediately invalidated when user is deleted Reporter: Sam Stoelinga Products: Keystone Affects: Folsom, Grizzly Description: Sam Stoelinga reported a vulnerability in Keystone. When users are deleted through Keystone v2 API, existing tokens for those users are not immediately invalidated and remain valid for the duration of the token's life (by default, up to 24 hours). This may result in users retaining access when the administrator of the system thought them disabled. You can workaround this issue by disabling a user before deleting it: in that case the tokens belonging to the disabled user are immediately invalidated. Keystone setups using the v3 API call to delete users are unaffected.
Created attachment 744263 [details] folsom-CVE-2013-2059.patch
Created attachment 744264 [details] grizzly-CVE-2013-2059.patch
Created attachment 744265 [details] havana-CVE-2013-2059.patch
References: http://www.openwall.com/lists/oss-security/2013/05/09/3 https://bugs.launchpad.net/keystone/+bug/1166670 Upstream patches: https://review.openstack.org/#/c/28677/ (Havana branch) https://review.openstack.org/#/c/28678/ (Grizzly branch) https://review.openstack.org/#/c/28679/ (Folsom branch)
Created openstack-keystone tracking bugs for this issue Affects: fedora-all [bug 961858] Affects: epel-6 [bug 961859]
openstack-keystone-2012.2.4-3.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
openstack-keystone-2013.1.1-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.