Vulnerability in python-keystoneclient package (CVE-2014-0105)
Summary
CVE-2014-0105: The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain... Affects keystone versions < 2013.1.1-2. Fixed in 2013.1.1-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-keystoneclient package is a Python client library for Keystone, which is an OpenStack service that provides authentication and authorization services. It allows users to interact with the Keystone API to manage users, roles, and tokens. The vulnerability (CVE-2014-0105) affects versions of python-keystoneclient before 0.7.0.
Vulnerability Detail
The vulnerability (CVE-2014-0105) in python-keystoneclient is due to a flaw in the auth_token middleware. It fails to properly retrieve user tokens from memcache, which can be exploited by remote authenticated users. By sending a large number of requests, an attacker can gain privileges in opportunistic circumstances. This vulnerability is caused by an interaction between eventlet and python-memcached.
How To Fix
Minimum fixed version
2013.1.1-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade keystoneTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability (CVE-2014-0105) in python-keystoneclient allows remote authenticated users to gain privileges by exploiting a flaw in the auth_token middleware. To fix this vulnerability, it is recommended to upgrade to python-keystoneclient version 0.7.0 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for keystone →
FAQ
The vulnerability allows remote authenticated users to gain privileges by exploiting the flaw in the auth_token middleware. This can lead to unauthorized access and potential misuse of the Keystone API.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
No, only versions before 0.7.0 are affected by this vulnerability. It is recommended to upgrade to the fixed version to mitigate the risk.
The urgency for fixing this vulnerability is considered low. However, it is still important to apply the fix to ensure the security of the Keystone authentication and authorization services.
You can find more information about this vulnerability in the CVE-2014-0105 JSON report available at the following source: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2014-0105.json
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
