1. Ubuntu Security Notices
  2. USN-2034-1

USN-2034-1: OpenStack Keystone vulnerability

Publication date

25 November 2013

Overview

Keystone would improperly remove roles when it was configured to use the LDAP backend.

Releases

Packages

Details

Brant Knudson discovered a logic error in the LDAP backend in Keystone
where removing a role on a tenant for a user who does not have that role
would instead add the role to the user. An authenticated user could use
this to gain privileges. Ubuntu is not configured to use the LDAP Keystone
backend by default.

Brant Knudson discovered a logic error in the LDAP backend in Keystone
where removing a role on a tenant for a user who does not have that role
would instead add the role to the user. An authenticated user could use
this to gain privileges. Ubuntu is not configured to use the LDAP Keystone
backend by default.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
13.10 saucy python-keystone –  1:2013.2-0ubuntu1.1
13.04 raring python-keystone –  1:2013.1.4-0ubuntu1.1
12.10 quantal python-keystone –  2012.2.4-0ubuntu3.3

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›