|
|
| |
|
| |
python-keystoneclient: multiple vulnerabilities
| Package(s): | python-keystoneclient |
CVE #(s): | CVE-2013-2166
CVE-2013-2167
|
| Created: | June 28, 2013 |
Updated: | July 3, 2013 |
| Description: |
From the Red Hat advisory:
A flaw was found in the way python-keystoneclient handled encrypted data
from memcached. Even when the memcache_security_strategy setting in
"/etc/swift/proxy-server.conf" was set to ENCRYPT to help prevent
tampering, an attacker on the local network, or possibly an unprivileged
user in a virtual machine hosted on OpenStack, could use this flaw to
bypass intended restrictions and modify data in memcached that will later
be used by services utilizing python-keystoneclient (such as Nova, Cinder,
Swift, Glance, and so on). (CVE-2013-2166)
A flaw was found in the way python-keystoneclient verified data from
memcached. Even when the memcache_security_strategy setting in
"/etc/swift/proxy-server.conf" was set to MAC to perform signature
checking, an attacker on the local network, or possibly an unprivileged
user in a virtual machine hosted on OpenStack, could use this flaw to
modify data in memcached that will later pass signature checking in
python-keystoneclient. (CVE-2013-2167) |
| Alerts: |
|
( Log in to post comments)
|
|
|