The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for
    a user who does not have that role, adds the role to the user, which allows local users to gain
    privileges. (CVE-2013-4477)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:0113 advisory.

    The openstack-keystone packages provide keystone, a Python implementation     of the OpenStack Identity service API, which provides Identity, Token,     Catalog, and Policy services.

    A flaw was discovered in the way the LDAP backend in keystone handled the     removal of a role. A user could unintentionally be granted a role if the     role being removed had not been previously granted to that user. Note that     only OpenStack Identity setups using an LDAP backend were affected.
    (CVE-2013-4477)

    All openstack-keystone users are advised to upgrade to these updated     packages, which contain a backported patch to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- Update to Havana stable release 2013.2.1

    - Havana GA

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Brant Knudson discovered a logic error in the LDAP backend in Keystone where removing a role on a tenant for a user who does not have that role would instead add the role to the user. An authenticated user could use this to gain privileges. Ubuntu is not configured to use the LDAP Keystone backend by default.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

update to 2013.1.4 stable/grizzly release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
433596	SCA: security update for keystone (GHSA-f889-wfwm-6p7m)	Tenable Cloud Security	SCA Checks	medium
433596	SCA: security update for keystone (GHSA-f889-wfwm-6p7m)	Tenable Self-Hosted Container Security	SCA Checks	medium
210180	RHEL 6 : openstack-keystone (RHSA-2014:0113)	Nessus	Red Hat Local Security Checks	medium
71765	Fedora 20 : openstack-keystone-2013.2.1-1.fc20 (2013-23589)	Nessus	Fedora Local Security Checks	low
71094	Ubuntu 12.10 / 13.04 / 13.10 : keystone vulnerability (USN-2034-1)	Nessus	Ubuntu Local Security Checks	low
70789	Fedora 19 : openstack-keystone-2013.1.4-2.fc19 (2013-20373)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2013-4477

medium

Tenable Plugins

medium

medium

medium

low

low

low