Kieran Spear from the University of Melbourne reported [1] a vulnerability in Keystone auth_token middleware (shipped in python-keystoneclient). By doing repeated requests, with sufficient load on the target system, an authenticated user may in certain situations assume another authenticated user's complete identity and multi-tenant authorizations, potentially resulting in a privilege escalation. Note that it is related to a bad interaction between eventlet and python-memcached that should be avoided if the calling process already monkey-patches "thread" to use eventlet. Only keystone middleware setups using auth_token with memcache are vulnerable. python-keystoneclient fix (included in 0.7.0 release): https://review.openstack.org/81078 [1] https://bugs.launchpad.net/bugs/1282865 Acknowledgements: Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Kieran Spear from the University of Melbourne as the original reporter.
Created python-keystoneclient tracking bugs for this issue: Affects: fedora-all [bug 1082172] Affects: epel-6 [bug 1082173]
This issue has been addressed in following products: OpenStack 4 for RHEL 6 Via RHSA-2014:0382 https://rhn.redhat.com/errata/RHSA-2014-0382.html
This issue has been addressed in following products: Red Hat Storage 2.1 Via RHSA-2014:0409 https://rhn.redhat.com/errata/RHSA-2014-0409.html
This issue has been addressed in following products: OpenStack 3 for RHEL 6 Via RHSA-2014:0442 https://rhn.redhat.com/errata/RHSA-2014-0442.html