Title: Trustee token revocation does not work with memcache backend Reporter: Morgan Fainberg (Metacloud) Products: Keystone Versions: 2013.1 up to 2013.1.4 and 2013.2 versions up to 2013.2.2 Description: Morgan Fainberg from Metacloud reported a vulnerability in the Keystone memcache token backend. When a trustor issues a trust token with impersonation enabled, the token is only added to the trustor's token list and not to the trustee's token list. This results in the trust token not being invalidated by the trustee's token revocation (bulk revocation). This is most noticeable when the trustee user is disabled or the trustee changes a password. Only setups using the memcache backend for tokens in Keystone are affected. CVE request: http://seclists.org/oss-sec/2014/q1/455 Upstream References: https://bugs.launchpad.net/keystone/+bug/1260080 https://git.openstack.org/cgit/openstack/keystone/commit/?id=813d1254eb4f7a7d40009b23bbadbc4c5cc5daac
This was assigned CVE-2014-2237: http://seclists.org/oss-sec/2014/q1/463
Created openstack-keystone tracking bugs for this issue: Affects: fedora-all [bug 1071493]
Official fixes have been released: Icehouse (development branch) fix: https://review.openstack.org/60743 Havana fix: https://review.openstack.org/75521 Grizzly fix: https://review.openstack.org/75526 Notes: This fix will be included in the icehouse-3 development milestone and in future 2013.1.5 and 2013.2.3 releases.
This issue has been addressed in following products: OpenStack 3 for RHEL 6 Via RHSA-2014:0368 https://rhn.redhat.com/errata/RHSA-2014-0368.html
openstack-keystone-2013.1.5-2.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
openstack-keystone-2013.2.3-2.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in following products: OpenStack 4 for RHEL 6 Via RHSA-2014:0580 https://rhn.redhat.com/errata/RHSA-2014-0580.html