-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2012-010 CVE: CVE-2012-3426 Date: July 27, 2012 Title: Various Keystone token expiration issues Impact: Medium Reporter: Derek Higgins Products: Keystone Affects: Essex, Folsom Description: Derek Higgins reported various issues affecting Keystone token expiration. A token expiration date can be circumvented by continuously creating new tokens before the old one has expired. Existing tokens also remain valid after a user account is disabled or after an account password changed. An authenticated and authorized user could potentially leverage those vulnerabilities to extend his access beyond the account owner expectations. Folsom fixes: http://github.com/openstack/keystone/commit/375838cfceb88cacc312ff6564e64eb18ee6a355 http://github.com/openstack/keystone/commit/628149b3dc6b58b91fd08e6ca8d91c728ccb8626 http://github.com/openstack/keystone/commit/a67b24878a6156eab17b9098fa649f0279256f5d Essex fixes: http://github.com/openstack/keystone/commit/29e74e73a6e51cffc0371b32354558391826a4aa http://github.com/openstack/keystone/commit/d9600434da14976463a0bd03abd8e0309f0db454 http://github.com/openstack/keystone/commit/ea03d05ed5de0c015042876100d37a6a14bf56de References: https://bugs.launchpad.net/keystone/+bug/998185 https://bugs.launchpad.net/keystone/+bug/997194 https://bugs.launchpad.net/keystone/+bug/996595 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2012-3426 Notes: Those fixes were already included in Keystone 2012.1.1 stable update and the Folsom-1 development milestone. - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBCAAGBQJQErMZAAoJEFB6+JAlsQQjMrkP/juA+StMaNQNNqfPyV4gFJHG mI/ZTFq7lf9HBqqxrKbWKdDdAW+AbGM+EXL6Vhu0xBCIk0Q9+dyj1t6BQd/Y/CMv Je5XWZ3YrufHtNI37I9We8hrNBz4WoVhAyLZNHPHmngRu/Dxz8BNtKC4mSrG5bLL ammjtdnecRLPa3GkqYi6tFQgKSzAiU/edXx0+h9veMaxvxKmDzwIKJ625p6CmouR esCnoMkC23e2IoDnq85WaoqK9V8PyMJJ8auU1P+olA/VdvTIXOPAiMOrclEOuFCw EVENPwXmzh/hM2LZKZSSmRgWxSvADfCWnTWc8VT0CvVbJXkOegwMgsFvzd/oy89Q huEu0HiBdOw7yDet5n1f63Es0NO108jEvlN4LNEF0emEv6fNo6rbKHpIqw5R+Dxp Yiu0j3XOiBhE6eIUvVdXv+mAvaRJsk9KzWQaAyrp2UKO52MU6G11+zwJpJCVCRod yjO2kSm1ksZzSF2ZmoteOeFdqJp11qI1LbfT6vswuacW1zrCPHbAM8RP1DS/5X4d PdgzJBZhE20G1YcY+kMMqIlmIs9hgP6IcaeHKxXcrW3Oq/flI00Rade/HmAamQ51 PsT9cVeE3uZt8plARG1SXyzQp8WF+U//H2af2BGiClX3TdrZU3EIOsKby77Xgwxl Z7A0lu7IqS1+4Fm/6738 =fX6q -----END PGP SIGNATURE-----