OpenStack Nova uses insecure keystone middleware tmpdir by default
keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2013-2030US | low2.1OT erhöht | — | ||
keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to s… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.htmlWEB
- http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.htmlWEB
- http://www.openwall.com/lists/oss-security/2013/05/09/2WEB
- https://bugs.launchpad.net/nova/+bug/1174608WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=958285WEB
- https://github.com/advisories/GHSA-pxxv-rv32-2qgvADVISORY
- https://github.com/openstack/novaPACKAGE
- https://github.com/openstack/nova/commit/58d6879b1caaa750c39c8e452a0634c24ffef2ceWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan