pysec-2013-45
Vulnerability from pysec
Published
2013-12-27 01:55
Modified
2024-11-21 14:22
Details
keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora.
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "nova",
"purl": "pkg:pypi/nova"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"15.1.5",
"16.1.6",
"16.1.7",
"16.1.8",
"17.0.10",
"17.0.11",
"17.0.12",
"17.0.13",
"17.0.7",
"17.0.8",
"17.0.9",
"18.0.2",
"18.0.3",
"18.1.0",
"18.2.0",
"18.2.1",
"18.2.2",
"18.2.3",
"18.3.0",
"19.0.0",
"19.0.0.0rc1",
"19.0.0.0rc2",
"19.0.1",
"19.0.2",
"19.0.3",
"19.1.0",
"19.2.0",
"19.3.0",
"19.3.1",
"19.3.2",
"20.0.0",
"20.0.0.0rc1",
"20.0.0.0rc2",
"20.0.1",
"20.1.0",
"20.1.1",
"20.2.0",
"20.3.0",
"20.4.0",
"20.4.1",
"20.5.0",
"20.6.0",
"20.6.1",
"21.0.0",
"21.0.0.0rc1",
"21.0.0.0rc2",
"21.1.0",
"21.1.1",
"21.1.2",
"21.2.0",
"21.2.1",
"21.2.2",
"21.2.3",
"21.2.4",
"22.0.0",
"22.0.0.0rc1",
"22.0.1",
"22.1.0",
"22.2.0",
"22.2.1",
"22.2.2",
"22.3.0",
"22.4.0",
"23.0.0",
"23.0.0.0rc1",
"23.0.0.0rc2",
"23.0.1",
"23.0.2",
"23.1.0",
"23.2.0",
"23.2.1",
"23.2.2",
"24.0.0",
"24.0.0.0rc1",
"24.0.0.0rc2",
"24.1.0",
"24.1.1",
"24.2.0",
"24.2.1",
"25.0.0",
"25.0.0.0rc1",
"25.0.1",
"25.1.0",
"25.1.1",
"25.2.0",
"25.2.1",
"25.3.0",
"26.0.0",
"26.0.0.0rc1",
"26.0.0.0rc2",
"26.1.0",
"26.1.1",
"26.2.0",
"26.2.1",
"26.2.2",
"26.3.0",
"27.0.0",
"27.0.0.0rc1",
"27.1.0",
"27.2.0",
"27.3.0",
"27.4.0",
"27.5.0",
"27.5.1",
"28.0.0",
"28.0.0.0rc1",
"28.0.1",
"28.1.0",
"28.2.0",
"28.3.0",
"29.0.0",
"29.0.0.0rc1",
"29.0.1",
"29.0.2",
"29.1.0",
"29.2.0",
"30.0.0",
"30.0.0.0rc1"
]
}
],
"aliases": [
"CVE-2013-2030"
],
"details": "keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora.",
"id": "PYSEC-2013-45",
"modified": "2024-11-21T14:22:56.793365Z",
"published": "2013-12-27T01:55:00Z",
"references": [
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/05/09/2"
},
{
"type": "FIX",
"url": "http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.html"
},
{
"type": "ADVISORY",
"url": "http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.html"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=958285"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/nova/+bug/1174608"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html"
}
],
"withdrawn": "2024-11-22T04:37:04Z"
}
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.