|
|
| |
|
| |
openstack-keystone: two authentication bypass flaws
| Package(s): | openstack-keystone |
CVE #(s): | CVE-2012-4456
CVE-2012-4457
|
| Created: | October 4, 2012 |
Updated: | October 10, 2012 |
| Description: |
From the Red Hat Bugzilla entries [1, 2]:
CVE-2012-4456: Jason Xu discovered several vulnerabilities in OpenStack
Keystone token verification:
The first occurs in the API /v2.0/OS-KSADM/services and
/v2.0/OS-KSADM/services/{service_id}, the second occurs in
/v2.0/tenants/{tenant_id}/users/{user_id}/roles
In both cases the OpenStack Keystone code fails to check if the tokens are
valid. These issues have been addressed by adding checks in the form of
test_service_crud_requires_auth() and test_user_role_list_requires_auth().
CVE-2012-4457: Token authentication for a user belonging to a disable tenant should not be
allowed. |
| Alerts: |
|
( Log in to post comments)
|
|
|