Insecure signing_dir configuration in barbican-api-paste.ini

[Charles Neill]

It appears that Barbican sets signing_dir to "/tmp/barbican/cache" in etc/barbican/barbican-api-paste.ini (Reference: https://github.com/openstack/barbican/blob/master/etc/barbican/barbican-api-paste.ini#L42)

A Nova bug from 2013 (https://bugs.launchpad.net/nova/+bug/1174608) mentions that they had the same basic issue, and it's a security issue because:
"This means that if an attacker populated the /tmp/keystone-signing-nova
with the appropriate files for signautre verification they could potentially
issue forged tokens which would be validated by the middleware. As:
    - The directory location deterministic. (default for glance, nova)
    - *If the directory already exists it is reused*"

This Nova bug was issued CVE-2013-2030: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-2030

This was originally reported to Barbican devs by the user "zigo" in the #openstack-barbican channel on Freenode:
2015-03-23 16:59:15 zigo_ I just saw in barbican-api-paste.ini a "signing_dir" directive. This is a security issue which you guys need to fix.
2015-03-23 16:59:28 zigo_ The signing_dir directive should never be set to /tmp like this.
2015-03-23 16:59:33 zigo_ Best is to simply remove the directive.
2015-03-23 16:59:57 zigo_ I can find the announce for the nova security patch that happened a few years ago if you don't just trust my words… :)

zigo's suggested fix was to remove the directive. It appears Cinder has taken this approach for their project (https://bugs.launchpad.net/cinder/+bug/1185098)

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/176071

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/176071
Committed: https://git.openstack.org/cgit/openstack/barbican/commit/?id=dce0c6922062a700a2de1fee9319421cc7d8288e
Submitter: Jenkins
Branch: master

commit dce0c6922062a700a2de1fee9319421cc7d8288e
Author: Charles Neill <email address hidden>
Date: Tue Apr 21 15:49:20 2015 -0500

    Removing signing_dir directive from config

    The signing_dir directive defined in barbican-api-paste.ini explicitly
    stores Keystone's signing certificates in a known /tmp directory. This
    could be exploited by populating the directory with bogus certificates,
    potentially allowing a malicious user to generate valid tokens.

    Added comment explaining signing_dir, and a reasonable
    (commented) default.

    Change-Id: I15fda6863e888e3881694ab47a836eee2fb578ee
    Closes-Bug: #1446406

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/kilo
Review: https://review.openstack.org/177378

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/177378
Committed: https://git.openstack.org/cgit/openstack/barbican/commit/?id=46184bb4b3a81e503a9e4aff4ba9ea0a66061a16
Submitter: Jenkins
Branch: stable/kilo

commit 46184bb4b3a81e503a9e4aff4ba9ea0a66061a16
Author: Charles Neill <email address hidden>
Date: Tue Apr 21 15:49:20 2015 -0500

    Removing signing_dir directive from config

    The signing_dir directive defined in barbican-api-paste.ini explicitly
    stores Keystone's signing certificates in a known /tmp directory. This
    could be exploited by populating the directory with bogus certificates,
    potentially allowing a malicious user to generate valid tokens.

    Added comment explaining signing_dir, and a reasonable
    (commented) default.

    Change-Id: I15fda6863e888e3881694ab47a836eee2fb578ee
    Closes-Bug: #1446406

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/179301

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/179301
Committed: https://git.openstack.org/cgit/openstack/barbican/commit/?id=80af5cbd25f49e0f96b10604978712643213d427
Submitter: Jenkins
Branch: master

commit e6f05febbe18a86e4e6b05acc5f4868fa3beb291
Author: Nathan Reller <email address hidden>
Date: Tue Apr 28 08:54:25 2015 -0400

    Fixed Bug for KMIP Secret Storage

    The KMIP secret store was incorrectly storing secrets. In some cases
    this resulted in extra information being stored with the keys and in
    other cases the key storage would fail with a 500 internal server
    error.

    This patch fixes the KMIP secret store to correctly store secrets.

    Change-Id: I94944a05776d366bd33d46ddb25f7129425405d0
    Co-authored-by: Kaitlin Farr <email address hidden>
    Closes-Bug: #1449234
    (cherry picked from commit 597869880f186ce951809fe85d5d7d0610f35c4f)

commit 604c402be0e50aaa305154dc1c39fda08b7566d9
Author: Arun Kant <email address hidden>
Date: Fri Apr 24 09:19:25 2015 -0700

    Fix for missing id check in ACL count query.

    Fixing issue and adding unit test to cover this API specifically.
    It may need to be backported to Kilo as well.

    Closes-Bug: #1447868

    Change-Id: I1d6cc4ea59ea767d08112b148fb6b085bb2c4859

commit 46184bb4b3a81e503a9e4aff4ba9ea0a66061a16
Author: Charles Neill <email address hidden>
Date: Tue Apr 21 15:49:20 2015 -0500

    Removing signing_dir directive from config

    The signing_dir directive defined in barbican-api-paste.ini explicitly
    stores Keystone's signing certificates in a known /tmp directory. This
    could be exploited by populating the directory with bogus certificates,
    potentially allowing a malicious user to generate valid tokens.

    Added comment explaining signing_dir, and a reasonable
    (commented) default.

    Change-Id: I15fda6863e888e3881694ab47a836eee2fb578ee
    Closes-Bug: #1446406

commit 4861932b51e491d217276f07f52e116179dc0d15
Author: Dave McCowan <email address hidden>
Date: Tue Apr 21 17:59:41 2015 -0400

    Fix failure with get on dict that was None

    When calling get_acl_dict_for_user() in the RBAC feature, the user list
    may be empty. In this case, make sure an empty list (not None) is
    returned so the receiving code won't fail.

    Change-Id: I6aeb94e03aa7898823ec408807180f7eeb2d2916
    Closes-bug: #1446826

commit b37c35c9229dab43e3d77e5061d06f34c787bc2b
Author: Dave McCowan <email address hidden>
Date: Fri Apr 24 08:50:09 2015 -0400

    Fix call to load_privatekey() when passphrase is None

    The original code worked, but breaks with PyOpenSSL 0.15.1,
    the version currently used by the gate.

    Closes-Bug: #1448193
    Change-Id: Iae44f08fa6442e3463e6b552955229f3fd36fbde

commit 93718aaa70d3f4523e636bfa6d602470e0d26b26
Author: OpenStack Proposal Bot <email address hidden>
Date: Mon Apr 20 17:54:00 2015 +0000

    Updated from global requirements

    Change-Id: Ife99d56a70c0ebd10a9ea47b06f969cd1e74b984

commit bb1cf4d54b2b7e95dd3f37d4c3f0cd1b0045ce7b
Author: Thierry Carrez <email address hidden>
Date: Mon Apr 20 18:26:05 2015 +0200
...