The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly
    before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote
    attackers to bypass intended access restrictions via a revoked PKI token. (CVE-2013-4294)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:1285 advisory.

    The openstack-keystone packages provide Keystone, a Python implementation     of the OpenStack identity service API, which provides Identity, Token,     Catalog, and Policy services.

    It was found that Keystone did not correctly handle revoked PKI tokens,     allowing users with revoked tokens to retain access to resources they     should no longer be able to access. This issue only affected systems using     PKI tokens with the memcache or KVS token back ends. (CVE-2013-4294)

    Red Hat would like to thank Thierry Carrez of OpenStack upstream for     reporting this issue. Upstream acknowledges Kieran Spear of University of     Melbourne as the original reporter.

    All users of openstack-keystone are advised to upgrade to these updated     packages, which correct these issues. After installing the updated     packages, the Keystone service (openstack-keystone) will be restarted     automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Chmouel Boudjnah discovered that Keystone did not properly invalidate user tokens when a tenant was disabled which allowed an authenticated user to retain access via the token. (CVE-2013-4222)

Kieran Spear discovered that Keystone did not properly verify PKI tokens when performing revocation when using the memcache and KVS backends. An authenticated attacker could exploit this to bypass intended access restrictions. (CVE-2013-4294).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
410982	SCA: security update for keystone (GHSA-5qpp-v56f-mqfm)	Tenable Cloud Security	SCA Checks	medium
410982	SCA: security update for keystone (GHSA-5qpp-v56f-mqfm)	Tenable Self-Hosted Container Security	SCA Checks	medium
193676	RHEL 6 : openstack-keystone (RHSA-2013:1285)	Nessus	Red Hat Local Security Checks	high
70581	Ubuntu 12.10 / 13.04 : keystone vulnerabilities (USN-2002-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2013-4294

medium

Tenable Plugins

medium

medium

high

medium