[Openstack-security] [Bug 1174499] Re: Keystone token hashing is MD5
Kurt Seifried
kseifried at redhat.com
Wed May 1 19:43:06 UTC 2013
One note:
http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=md5
Second note:
based on Adam Young's comments it sounds like even the ability to forge arbitrary MD5 hashes would not be directly exploitable as 1) the MD5 hashes are created by keystone and 2) the hashed value is a PKI token so there's an additional level pf protection. Is this correct?
--
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1174499
Title:
Keystone token hashing is MD5
Status in OpenStack Identity (Keystone):
Confirmed
Bug description:
https://github.com/openstack/python-
keystoneclient/blob/master/keystoneclient/common/cms.py
def cms_hash_token(token_id):
"""
return: for ans1_token, returns the hash of the passed in token
otherwise, returns what it was passed in.
"""
if token_id is None:
return None
if is_ans1_token(token_id):
hasher = hashlib.md5()
hasher.update(token_id)
return hasher.hexdigest()
else:
return token_id
MD5 is a deprecated mechanism, it should be replaces with at least SHA1, if not SHA256.
Keystone should be able to support multiple Hash types, and the auth_token middleware should query Keystone to find out which type is in use.
To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1174499/+subscriptions
More information about the Openstack-security
mailing list