The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient)
    before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users
    to gain privileges in opportunistic circumstances via a large number of requests, related to an
    "interaction between eventlet and python-memcached." (CVE-2014-0105)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:0382 advisory.

    Python-keystoneclient is a client library and a command line utility for     interacting with the OpenStack Identity API. The OpenStack Identity     auth_token middleware component handles the authentication of tokens     with keystone.

    When using the auth_token middleware with the memcached token cache     enabled, a token for a different identity could be returned. An     authenticated user could use this flaw to escalate their privileges by     making repeated requests that could eventually allow the user to acquire     the administrator's identity. Note that only OpenStack Identity setups     using auth_token with memcached were affected. (CVE-2014-0105)

    Red Hat would like to thank the OpenStack project for reporting this issue.
    Upstream acknowledges Kieran Spear from the University of Melbourne as the     original reporter.

    The python-keystoneclient package has been upgraded to version 0.7.1.
    Additionally, the python-six package has been upgraded to version 1.5.2,     required by the updated python-keystoneclient package.

    All python-keystoneclient users are advised to upgrade to these updated     packages, which correct this issue. After installing this update, all     OpenStack services using auth_token must be restarted for this update to     take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated python-keystoneclient packages that fix one security issue are now available for Red Hat Storage 2.1.

The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Python-keystoneclient is a client library and a command line utility for interacting with the OpenStack Identity API. The OpenStack Identity auth_token middleware component handles the authentication of tokens with keystone. The gluster-swift component, provided by Red Hat Storage, requires the auth_token middleware.

When using the auth_token middleware with the memcached token cache enabled, a token for a different identity could be returned. An authenticated user could use this flaw to escalate their privileges by making repeated requests that could eventually allow the user to acquire the administrator's identity. Note that only OpenStack Identity setups using auth_token with memcached were affected.
(CVE-2014-0105)

Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Kieran Spear from the University of Melbourne as the original reporter.

The python-keystoneclient package has been upgraded to version 0.7.1.
Additionally, the python-six package has been upgraded to version 1.5.2, as required by the updated python-keystoneclient package.

All python-keystoneclient users are advised to upgrade to these updated packages, which correct this issue. After installing this update, the gluster-swift proxy, or any other services using auth_token, must be restarted for this update to take effect.

- Depend on correct python-six version Fix CVE-2014-0105     by update to upstream 0.7.1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
432521	SCA: security update for python-keystoneclient (GHSA-gwvq-rgqf-993f)	Tenable Cloud Security	SCA Checks	low
432521	SCA: security update for python-keystoneclient (GHSA-gwvq-rgqf-993f)	Tenable Self-Hosted Container Security	SCA Checks	low
234405	RHEL 6 : python-keystoneclient (RHSA-2014:0382)	Nessus	Red Hat Local Security Checks	low
79009	RHEL 6 : Storage Server (RHSA-2014:0409)	Nessus	Red Hat Local Security Checks	medium
73816	Fedora 20 : python-keystoneclient-0.7.1-2.fc20 (2014-5555)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-0105

low

Tenable Plugins

low

low

low

medium

medium