[Openstack-security] [Bug 1174608] Fix merged to python-keystoneclient (master)
OpenStack Hudson
1174608 at bugs.launchpad.net
Wed May 8 16:42:51 UTC 2013
Reviewed: https://review.openstack.org/28572
Committed: http://github.com/openstack/python-keystoneclient/commit/1736e2ffb12f70eeebed019448bc14def48aa036
Submitter: Jenkins
Branch: master
commit 1736e2ffb12f70eeebed019448bc14def48aa036
Author: Dolph Mathews <dolph.mathews at gmail.com>
Date: Wed May 8 10:49:20 2013 -0500
Securely create signing_dir (bug 1174608)
Also verifies the security of an existing signing_dir.
Change-Id: I0685b4274a94ad3974a2b2a7ab3f45830d3934bb
--
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1174608
Title:
Insecure directory creation for signing
Status in OpenStack Identity (Keystone):
Invalid
Status in Keystone folsom series:
In Progress
Status in OpenStack Compute (Nova):
In Progress
Status in OpenStack Compute (nova) folsom series:
In Progress
Status in OpenStack Compute (nova) grizzly series:
In Progress
Status in Python client library for Keystone:
Fix Committed
Bug description:
Originally found by Grant Murphy (gmurphy at redhat.com):
The signing directory is used to store the signing certificates
and the default location for this directory is:
signing_dir = /tmp/keystone-signing-nova
In the file:
keystone/middleware/auth_token.py
During the initialization of the AuthMiddleware the following
operations are made for the signing directory:
IF the directory exists but cannot be written to a configuration error is raised.
ELSE IF the directory doesn't exist, create it.
NEXT chmod permisions(stat.S_IRWXU) to the signing_directory
AFAICT The signing certificates used in validation will only be
fetched from the keystone if the cms_verify action raises an exception
because the certificate file is missing from the signing directory.
This means that if an attacker populated the /tmp/keystone-signing-nova
with the appropriate files for signautre verification they could potentially
issue forged tokens which would be validated by the middleware. As:
- The directory location deterministic. (default for glance, nova)
- *If the directory already exists it is reused*
To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1174608/+subscriptions
More information about the Openstack-security
mailing list