CVE-2013-2157

Related Files

Red Hat Security Advisory 2013-1083-01

Posted Jul 17, 2013

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-1083-01 - The openstack-keystone packages provide Keystone, a Python implementation of the OpenStack identity service API, which provides Identity, Token, Catalog, and Policy services. A flaw was found in the way Keystone handled LDAP based authentication. If Keystone was configured to use LDAP authentication, and the LDAP server was configured to allow anonymous binds, anyone able to connect to a given service using Keystone could connect as any user, including the admin, without supplying a password.

tags | advisory, python

systems | linux, redhat

advisories | CVE-2013-2157

SHA-256 | f7335f06806387494c444983aa45f063b423edb34d8f85e771e34b0897104964

Download | Favorite | View

Red Hat Security Advisory 2013-0994-01

Posted Jun 27, 2013

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0994-01 - The openstack-keystone packages provide Keystone, a Python implementation of the OpenStack identity service API, which provides Identity, Token, Catalog, and Policy services. A flaw was found in the way Keystone handled LDAP based authentication. If Keystone was configured to use LDAP authentication, and the LDAP server was configured to allow anonymous binds, anyone able to connect to a given service using Keystone could connect as any user, including the admin, without supplying a password.

tags | advisory, python

systems | linux, redhat

advisories | CVE-2013-2157

SHA-256 | 32c7604db4e8db147fcbddd83a091aa60f03d25791155e16d28b79f42a471506

Download | Favorite | View

Ubuntu Security Notice USN-1875-1

Posted Jun 14, 2013

Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1875-1 - Eoghan Glynn and Alex Meade discovered that Keystone did not properly perform expiry checks for the PKI tokens used in Keystone. If Keystone were setup to use PKI tokens, a previously authenticated user could continue to use a PKI token for longer than intended. This issue only affected Ubuntu 12.10 which does not use PKI tokens by default. Jose Castro Leon discovered that Keystone did not properly authenticate users when using the LDAP backend. An attacker could obtain valid tokens and impersonate other users by supplying an empty password. By default, Ubuntu does not use the LDAP backend. Various other issues were also addressed.

tags | advisory

systems | linux, ubuntu

advisories | CVE-2013-2104, CVE-2013-2157, CVE-2013-2104, CVE-2013-2157

SHA-256 | 1cb5daa1d046cc30e236c0c00c00ef32e4a05f8cd353fce3c781247855fb7f22

Download | Favorite | View