Open Stack

Reviewed:  https://review.openstack.org/179301
Committed: https://git.openstack.org/cgit/openstack/barbican/commit/?id=80af5cbd25f49e0f96b10604978712643213d427
Submitter: Jenkins
Branch:    master

commit e6f05febbe18a86e4e6b05acc5f4868fa3beb291
Author: Nathan Reller <Nathan.Reller at jhuapl.edu>
Date:   Tue Apr 28 08:54:25 2015 -0400

    Fixed Bug for KMIP Secret Storage
    
    The KMIP secret store was incorrectly storing secrets. In some cases
    this resulted in extra information being stored with the keys and in
    other cases the key storage would fail with a 500 internal server
    error.
    
    This patch fixes the KMIP secret store to correctly store secrets.
    
    Change-Id: I94944a05776d366bd33d46ddb25f7129425405d0
    Co-authored-by: Kaitlin Farr <Kaitlin.Farr at jhuapl.edu>
    Closes-Bug: #1449234
    (cherry picked from commit 597869880f186ce951809fe85d5d7d0610f35c4f)

commit 604c402be0e50aaa305154dc1c39fda08b7566d9
Author: Arun Kant <arun.kant at hp.com>
Date:   Fri Apr 24 09:19:25 2015 -0700

    Fix for missing id check in ACL count query.
    
    Fixing issue and adding unit test to cover this API specifically.
    It may need to be backported to Kilo as well.
    
    Closes-Bug: #1447868
    
    Change-Id: I1d6cc4ea59ea767d08112b148fb6b085bb2c4859

commit 46184bb4b3a81e503a9e4aff4ba9ea0a66061a16
Author: Charles Neill <charles.neill at rackspace.com>
Date:   Tue Apr 21 15:49:20 2015 -0500

    Removing signing_dir directive from config
    
    The signing_dir directive defined in barbican-api-paste.ini explicitly
    stores Keystone's signing certificates in a known /tmp directory. This
    could be exploited by populating the directory with bogus certificates,
    potentially allowing a malicious user to generate valid tokens.
    
    Added comment explaining signing_dir, and a reasonable
    (commented) default.
    
    Change-Id: I15fda6863e888e3881694ab47a836eee2fb578ee
    Closes-Bug: #1446406

commit 4861932b51e491d217276f07f52e116179dc0d15
Author: Dave McCowan <dmccowan at cisco.com>
Date:   Tue Apr 21 17:59:41 2015 -0400

    Fix failure with get on dict that was None
    
    When calling get_acl_dict_for_user() in the RBAC feature, the user list
    may be empty.  In this case, make sure an empty list (not None) is
    returned so the receiving code won't fail.
    
    Change-Id: I6aeb94e03aa7898823ec408807180f7eeb2d2916
    Closes-bug: #1446826

commit b37c35c9229dab43e3d77e5061d06f34c787bc2b
Author: Dave McCowan <dmccowan at cisco.com>
Date:   Fri Apr 24 08:50:09 2015 -0400

    Fix call to load_privatekey() when passphrase is None
    
    The original code worked, but breaks with PyOpenSSL 0.15.1,
    the version currently used by the gate.
    
    Closes-Bug: #1448193
    Change-Id: Iae44f08fa6442e3463e6b552955229f3fd36fbde

commit 93718aaa70d3f4523e636bfa6d602470e0d26b26
Author: OpenStack Proposal Bot <openstack-infra at lists.openstack.org>
Date:   Mon Apr 20 17:54:00 2015 +0000

    Updated from global requirements
    
    Change-Id: Ife99d56a70c0ebd10a9ea47b06f969cd1e74b984

commit bb1cf4d54b2b7e95dd3f37d4c3f0cd1b0045ce7b
Author: Thierry Carrez <thierry at openstack.org>
Date:   Mon Apr 20 18:26:05 2015 +0200

    Update .gitreview to match stable/kilo
    
    Change-Id: I6d6a396924b338fe7cca3fc381feda8752491f56

-- 
You received this bug notification because you are a member of OpenStack
Security, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1446406

Title:
  Insecure signing_dir configuration in barbican-api-paste.ini

Status in OpenStack Key Management (Barbican):
  Fix Committed
Status in Barbican kilo series:
  Fix Released

Bug description:
  It appears that Barbican sets signing_dir to "/tmp/barbican/cache" in
  etc/barbican/barbican-api-paste.ini (Reference:
  https://github.com/openstack/barbican/blob/master/etc/barbican
  /barbican-api-paste.ini#L42)

  A Nova bug from 2013 (https://bugs.launchpad.net/nova/+bug/1174608) mentions that they had the same basic issue, and it's a security issue because:
  "This means that if an attacker populated the /tmp/keystone-signing-nova
  with the appropriate files for signautre verification they could potentially
  issue forged tokens which would be validated by the middleware. As:
      - The directory location deterministic. (default for glance, nova)
      - *If the directory already exists it is reused*"

  This Nova bug was issued CVE-2013-2030: http://www.cve.mitre.org/cgi-
  bin/cvename.cgi?name=2013-2030

  This was originally reported to Barbican devs by the user "zigo" in the #openstack-barbican channel on Freenode:
  2015-03-23 16:59:15 zigo_   I just saw in barbican-api-paste.ini a "signing_dir" directive. This is a security issue which you guys need to fix.
  2015-03-23 16:59:28 zigo_   The signing_dir directive should never be set to /tmp like this.
  2015-03-23 16:59:33 zigo_   Best is to simply remove the directive.
  2015-03-23 16:59:57 zigo_   I can find the announce for the nova security patch that happened a few years ago if you don't just trust my words… :)

  zigo's suggested fix was to remove the directive. It appears Cinder
  has taken this approach for their project
  (https://bugs.launchpad.net/cinder/+bug/1185098)

To manage notifications about this bug go to:
https://bugs.launchpad.net/barbican/+bug/1446406/+subscriptions