OSSA-2013-010: Nova uses insecure keystone middleware tmpdir by default¶
- Date:
May 09, 2013
- CVE:
CVE-2013-2030
Affects¶
Nova: Folsom, Grizzly
Description¶
Grant Murphy from Red Hat and Anton Lundin both independently reported a vulnerability in Nova’s default location for the Keystone middleware signing directory (signing_dir). By previously setting up a malicious directory structure, an attacker with local shell access on the Nova node could potentially issue forged tokens that would be accepted by the middleware. Only setups that use the default value for signing_dir are affected. Note that future versions of the Keystone middleware will issue a warning if an insecure signing directory is used.
Patches¶
https://review.openstack.org/#/c/28569 (Grizzly)
Credits¶
Grant Murphy from Red Hat (CVE-2013-2030)
Anton Lundin (CVE-2013-2030)
