-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2013-015 CVE: CVE-2013-2157 Date: June 13, 2013 Title: Authentication bypass when using LDAP backend Reporter: Jose Castro Leon (CERN) Products: Keystone Affects: Folsom, Grizzly Description: Jose Castro Leon from CERN reported a vulnerability in the way the Keystone LDAP backend authenticates users. When provided with an empty password, the backend would perform an anonymous LDAP bind that would result in successfully authenticating the user. An attacker could therefore easily impersonate and get valid tokens for any user. Only Keystone setups using LDAP authentication backend are affected. Havana (development branch) fix: https://review.openstack.org/#/c/32896/ Grizzly fix: https://review.openstack.org/#/c/32895/ Folsom fix: https://review.openstack.org/#/c/32894/ References: https://bugs.launchpad.net/keystone/+bug/1187305 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2157 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJRue20AAoJEFB6+JAlsQQjiHQP/1Jd8p9Zezo70Vdm4oZksDzH IPuFfeCRUhLvDC1ygz33/7CbRkFtmJS8C+PG+WxiG/49bsCBfIN5fHlOf3DY2X1U 9zgodo3Tm/LwKCrpdceu4VCABt7CtO/CsHnuQGWBOf06MLDTqDvz3LQKpcPXO50l 1OHiOWEX9nbCkNKRCPfK4QfrzbJM5GufEeoEEfKk8ZctivvI2M56OcSiGMdOhGK8 Xw+0bGzBBZzBMhiMq2iw7y0JqWtRLTND/AAP1eyjbHL/xDG/rTtECGaGuONXjpSk WQRpWMznJY83fBnxnVAvKvf6OxG8IW8YNicvTgfx5v9gvX0U00r59y24ClnmvBxb oRWES8bRLHmjf8vTtfZwcATEfUUFZZK+9VUsaIRsRF6+gF/fbQq39SdVESQACvks Sf9/f/Tu6u+58Je2JaTmx3LLV6u12ellP/GUr31OyihKAxFGK4Y1tdrO3v4+u2ZF lSC361D5r5cczTosmXy5HjXwfjATaGuMb1ycDKCmO+98gsluQ1exDFnIXCw38weN KWJIp5zVCdTF0rqZCr3xDBSe4aukX8niBJNnvgJwELAddIWZ6FHUuEsgl3UPs7ZD E+issrQHaGtOJpNvoj17uxxnTY2VrtJ2AjxiU7y+hmt9tHh78rx+OhAdn7zPdoeT EEJ4OWpjLDKre9HsJVxX =kubz -----END PGP SIGNATURE-----