python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remote authenticated users to (1) retain use of a token after it has expired, or (2) use a revoked token once it expires.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry
    for PKI tokens, which allows remote authenticated users to (1) retain use of a token after it has expired,
    or (2) use a revoked token once it expires. (CVE-2013-2104)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0944 advisory.

    Python-keystoneclient is the client library and command line utility for     interacting with the OpenStack identity API.

    A flaw in Keystone allowed an attacker with access to the web and network     interfaces of services utilizing python-keystoneclient (such as Nova,     Cinder, Swift, Glance, and so on) to continue using PKI tokens that had     expired. This would allow the attacker to continue using the PKI tokens     despite the PKI tokens being expired, giving them continued access to     OpenStack services. (CVE-2013-2104)

    This issue was discovered by Eoghan Glynn of Red Hat.

    This update also fixes a number of bugs in python-keystoneclient.

    All users of Red Hat OpenStack 3.0 (Grizzly) Preview are advised to install     these updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update of openstack-keystone fixes two security vulnerabilities.

  - Add CVE-2013-2104.patch: fix missing expiration check in     Keystone PKI token validation (CVE-2013-2104,     bnc#821201)

  - Add CVE-2013-2157.patch: fix authentication bypass when     using LDAP backend (CVE-2013-2157, bnc#823783)

Selective backports from stable/grizzly :

  - Ec2Signer: Initial support for v4 signature     verification.

    - Allow signature verification for older boto versions.

    - Default signing_dir to secure temp dir.

    - Fix memcache encryption middleware. (CVE-2013-2166,       CVE-2013-2167)

    - Check token expiry. (CVE-2013-2104)

    - Allow secure user password update. (CVE-2013-2013)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

authtoken: Check token expiry CVE-2013-2104 Force simple Bind for authentication CVE-2013-2157

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Eoghan Glynn and Alex Meade discovered that Keystone did not properly perform expiry checks for the PKI tokens used in Keystone. If Keystone were setup to use PKI tokens, a previously authenticated user could continue to use a PKI token for longer than intended. This issue only affected Ubuntu 12.10 which does not use PKI tokens by default.
(CVE-2013-2104)

Jose Castro Leon discovered that Keystone did not properly authenticate users when using the LDAP backend. An attacker could obtain valid tokens and impersonate other users by supplying an empty password. By default, Ubuntu does not use the LDAP backend.
(CVE-2013-2157).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Eoghan Glynn and Alex Meade discovered that python-keystoneclient did not properly perform expiry checks for the PKI tokens used in Keystone. If Keystone were setup to use PKI tokens (the default in Ubuntu 13.04), a previously authenticated user could continue to use a PKI token for longer than intended.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
433027	SCA: security update for python-keystoneclient (GHSA-4rrr-j7ff-r844)	Tenable Cloud Security	SCA Checks	Local	high
433027	SCA: security update for python-keystoneclient (GHSA-4rrr-j7ff-r844)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
234385	RHEL 6 : python-keystoneclient (RHSA-2013:0944)	Nessus	Red Hat Local Security Checks	Local	high
75063	openSUSE Security Update : openstack-keystone (openSUSE-SU-2013:1089-1)	Nessus	SuSE Local Security Checks	Local	medium
69361	Fedora 19 : python-keystoneclient-0.2.3-7.fc19 (2013-14302)	Nessus	Fedora Local Security Checks	Local	medium
69288	Fedora 18 : openstack-keystone-2012.2.4-5.fc18 (2013-10713)	Nessus	Fedora Local Security Checks	Local	medium
66893	Ubuntu 12.10 / 13.04 : keystone vulnerabilities (USN-1875-1)	Nessus	Ubuntu Local Security Checks	Local	medium
66783	Ubuntu 13.04 : python-keystoneclient vulnerability (USN-1851-1)	Nessus	Ubuntu Local Security Checks	Local	medium

Detections

Analytics

CVE-2013-2104

high

Tenable Plugins

high

high

high

medium

medium

medium

medium

medium