<font size=2 face="sans-serif">Hi,</font>
<br>
<br><font size=2 face="sans-serif">Following the declaration regarding
the memcache vulnerability below, I would like to raise a discussion regarding
its protection. If we could limit/control the access to memcache it would
be easier to confine the damage in case of an attack. For example, in the
attached paper we added a gatekeeper to ensure that the keys/values
stored in the memcached of Swift are accessed only by the tenant/domain
to which they belong (e.g., a user from domain A can not access the cached
data of users belonging to domain B), </font>
<br>
<br><font size=2 face="sans-serif">I suggest to provide a generic mechanism
allowing insertion of various memcache protections as dedicated middleware
modules. Practically, although in Swift we have a module memcache.py which
is part of middleware, the module memcached.py is located under "common".
What is the motivation for this code organization? Can we move the module
memcached.py to be under "middleware" in Swift? </font>
<br>
<br><font size=2 face="sans-serif">Thank you very much,</font>
<br><font size=2 face="sans-serif">Alex.</font>
<br><font size=2 face="sans-serif"> </font>
<br>
<br>
<br><font size=2 face="sans-serif">----------------------------------------------------------<br>
Alexandra Shulman-Peleg, PhD<br>
Storage Research, Cloud Platforms Dept.<br>
IBM Haifa Research Lab<br>
Tel: +972-3-7689530 | Fax: +972-3-7689545</font>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">Thierry Carrez <thierry@openstack.org></font>
<br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">openstack-announce@lists.openstack.org,
openstack@lists.openstack.org, </font>
<br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">11/09/2013 06:52 PM</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">[Openstack]
[OSSA 2013-025] Token revocation failure using Keystone memcache/KVS backends
(CVE-2013-4294)</font>
<br>
<hr noshade>
<br>
<br>
<br><tt><font size=2>-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA256<br>
<br>
OpenStack Security Advisory: 2013-025<br>
CVE: CVE-2013-4294<br>
Date: September 11, 2013<br>
Title: Token revocation failure using Keystone memcache/KVS backends<br>
Reporter: Kieran Spear (University of Melbourne)<br>
Products: Keystone<br>
Affects: Folsom, Grizzly<br>
<br>
Description:<br>
Kieran Spear from the University of Melbourne reported a vulnerability<br>
in Keystone memcache and KVS token backends. The PKI token revocation<br>
lists stored the entire token instead of the token ID, triggering<br>
comparison failures, ultimately resulting in revoked PKI tokens still<br>
being considered valid. Only Folsom and Grizzly Keystone setups making<br>
use of PKI tokens with the memcache or KVS token backends are affected.<br>
Havana setups, setups using UUID tokens, or setups using PKI tokens with<br>
the SQL token backend are all unaffected.<br>
<br>
Grizzly fix:<br>
</font></tt><a href=https://review.openstack.org/#/c/46080/><tt><font size=2>https://review.openstack.org/#/c/46080/</font></tt></a><tt><font size=2><br>
<br>
Folsom fix:<br>
</font></tt><a href=https://review.openstack.org/#/c/46079/><tt><font size=2>https://review.openstack.org/#/c/46079/</font></tt></a><tt><font size=2><br>
<br>
References:<br>
</font></tt><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4294"><tt><font size=2>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4294</font></tt></a><tt><font size=2><br>
</font></tt><a href="https://bugs.launchpad.net/keystone/+bug/1202952"><tt><font size=2>https://bugs.launchpad.net/keystone/+bug/1202952</font></tt></a><tt><font size=2><br>
<br>
Regards,<br>
<br>
- -- <br>
Thierry Carrez<br>
OpenStack Vulnerability Management Team<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.12 (GNU/Linux)<br>
Comment: Using GnuPG with undefined - </font></tt><a href=http://www.enigmail.net/><tt><font size=2>http://www.enigmail.net/</font></tt></a><tt><font size=2><br>
<br>
iQIcBAEBCAAGBQJSMI+5AAoJEFB6+JAlsQQj2hAQAI/S5bAv+XrYUaXRBgJxvBz4<br>
xVXdrXl/iA7R9iDIlmaFThOCvw4SCsWB7jBYRv8wAk3V3HZw9jEmC3OoebpCFWNb<br>
1q3an25kroviy8rfZyQIqe9KTrwXRa/jDVlun2EEiw7KyUty/HIAjUCVUXVKBhyh<br>
8Bctn90A/Nt2D5Am3hyofsS5fOjmzwW6b73RCY7CDntduxUtPn6lbUthFESXTCwv<br>
lojClZ5X78XnCh2/WJuxKkAEm8EujlNqkIHziGgc3HrForxSc2GKSPzgFbg5eBbt<br>
BaDTxFkDHW3EwSK/69b+699e9BvN/vuBxbNa7YW2ANiM1IJ34QHouPk4XULMZIeH<br>
cZ4QOBX7MtUhvD1htfTlHQfvb1syqlvul49WVmmsk48CMVW6hArSMQvTVbArUqD0<br>
fN2INqfghZMQCkQIlXE+38J88OOL/S+sq6p8dIn96JxP2tnw4rIs9YclSa9E1Ub0<br>
SIDaWPu7NN+wuY1WN+EzHV0zHI8HYs2HkOlrRW3E02JEm3xcEEmYLCwf+c2mwOee<br>
Grick3VlxNuQNBP6bls+NtxCzhUzLVI7nOfaxZyzQtOMLjJPKpip4QKMjzotO3nf<br>
+6JNk5766T2f63fsNtw0kltbtm4R+RzKzv29vVsaOh+ba57w7xnpEkAA1oaYyFa+<br>
IHvUVYkOhX3quLUgBkCR<br>
=pm0d<br>
-----END PGP SIGNATURE-----<br>
<br>
_______________________________________________<br>
Mailing list: </font></tt><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack"><tt><font size=2>http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</font></tt></a><tt><font size=2><br>
Post to : openstack@lists.openstack.org<br>
Unsubscribe : </font></tt><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack"><tt><font size=2>http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</font></tt></a><tt><font size=2><br>
<br>
</font></tt>