CVE-2013-2104: python-keystoneclient Token Expiry Check Bypass

Background

python-keystoneclient is a Python library used in OpenStack Keystone (Folsom) for interacting with the Keystone identity service. It provides authentication and authorization services for other OpenStack services. The library allows users to manage and authenticate tokens for accessing OpenStack resources.

Vulnerability Detail

The vulnerability identified as CVE-2013-2104 affects python-keystoneclient versions prior to 0.2.4. It relates to the improper expiry check for PKI tokens. This flaw enables remote authenticated users to exploit two scenarios: (1) retain the use of a token even after it has expired, and (2) utilize a revoked token once it expires. The absence of proper token expiry validation can lead to unauthorized access and potential security breaches within OpenStack Keystone deployments.

pip install --upgrade "python-keystoneclient==6.0.0"

pip install --upgrade "python-keystoneclient==0.2.4"

Workaround

As a temporary workaround, users can manually implement additional token expiry checks within their applications or scripts that utilize python-keystoneclient. This can be achieved by validating the token's expiry time against the current time before allowing any further operations. Here's an example in Python:

import time
from keystoneclient import session

def validate_token_expiry(token):
    current_time = int(time.time())
    if token.expires_at < current_time:
        raise Exception('Token has expired')

# Usage
token = session.get_token()
validate_token_expiry(token)

Conclusion

The vulnerability identified as CVE-2013-2104 in python-keystoneclient allows remote authenticated users to bypass token expiry checks, potentially leading to unauthorized access and security breaches. It is crucial to upgrade to python-keystoneclient version 0.2.4 or later to mitigate this vulnerability. Additional token expiry checks can be implemented as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for python-keystoneclient →

FAQ