[pre-OSSA] Vulnerability in OpenStack keystonemiddleware (CVE-2015-1852)

[Alexander Makarov]

Brant Knudson from IBM reported a vulnerability in keystonemiddleware
(formerly shipped as python-keystoneclient). When the 'insecure' option
is set in a S3Token paste configuration file its value is effectively
ignored and instead assumed to be true. As a result certificate
verification will be disabled, leaving TLS connections open to MITM
attacks. Note that it's unusual to explicitly add this option and then
set it to false, so the impact of this bug is thought to be limited. All
versions of s3_token middleware with TLS settings configured are
affected by this flaw.

[Alexey Galkin (agalkin)]

On verification in 6.1.x

[Alexey Galkin (agalkin)]

Tested on iso #455.
Deployed env with: Juno on Ubuntu 14.04.1 (2014.2.2-6.1)
Keystone client(keystonemiddleware) with /usr/lib/python2.7/dist-packages/keystoneclient/middleware/s3_token.py [line 122] has been fixed, but the file /usr/lib/python2.7/dist-packages/keystonemiddleware/s3_token.py [line 118] remains unchanged. Are you sure that this is correct?
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
/usr/lib/python2.7/dist-packages/keystonemiddleware/s3_token.py - > http://paste.openstack.org/show/236715/
/usr/lib/python2.7/dist-packages/keystoneclient/middleware/s3_token.py - > http://paste.openstack.org/show/236716/

[Alexey Galkin (agalkin)]

I'm sorry, confused files.

Keystone client(keystonemiddleware) with /usr/lib/python2.7/dist-packages/keystonemiddleware/s3_token.py [line 122] has been fixed, but the file /usr/lib/python2.7/dist-packages/keystoneclient/middleware/s3_token.py [line 118] remains unchanged.

[Timur Nurlygayanov (tnurlygayanov)]

So, looks like this bug was not completely fixed, we need to investigate the issue with duplicated code without the fix and fix it again in MOS 6.1

[Alexander Makarov (amakarov)]

Specs are needed to merge changes for keystonemiddleware in MOS 6.x

[Alexander Makarov (amakarov)]

https://review.fuel-infra.org/gitweb?p=openstack-build%2Fkeystonemiddleware-build.git;a=shortlog;h=refs%2Fheads%2Fopenstack-ci%2Ffuel-6.1%2F2014.2

[Dmitry Mescheryakov (dmitrymex)]

After talking with Dmitry Burmistrov we decided that we will continue tracking keystonemiddleware in packages/* repo, not in openstack/* because otherwise we will have issues with wrong packages' version order.

Reassigning the bug back to Alexander as it is he who makes the patches.

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: openstack-ci/fuel-5.1.1-updates/2014.1.1
Change author: Alexandr Nevenchannyy <email address hidden>
Review: https://review.fuel-infra.org/9286

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/9286
Submitter: Vitaly Sedelnik <email address hidden>
Branch: openstack-ci/fuel-5.1.1-updates/2014.1.1

Commit: 620f4d1fe8045fe1e142187268a4145024d45f3d
Author: Alexandr Nevenchannyy <email address hidden>
Date: Thu Jul 16 15:54:06 2015

Fix s3_token middleware parsing insecure option

Added function _bool_from_string from oslo.utils

Closes-Bug: #1449023

Change-Id: Ie994c05e781668fcf855d1fa481df0fd59421fd4
Closes-bug: #1442579
Closes-Bug: #1449023

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: openstack-ci/fuel-5.1-updates/2014.1.1
Change author: Alexandr Nevenchannyy <email address hidden>
Review: https://review.fuel-infra.org/9441

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/9441
Submitter: Vitaly Sedelnik <email address hidden>
Branch: openstack-ci/fuel-5.1-updates/2014.1.1

Commit: da8749c64263fd5361a99d91e461daab155e9186
Author: Alexandr Nevenchannyy <email address hidden>
Date: Thu Jul 23 15:59:10 2015

Fix s3_token middleware parsing insecure option

Added function _bool_from_string from oslo.utils.

Closes-Bug: #1449023

Change-Id: Ie994c05e781668fcf855d1fa481df0fd59421fd4
Closes-bug: #1442579
Closes-Bug: #1449023
(cherry picked from commit 620f4d1fe8045fe1e142187268a4145024d45f3d)

[Oleksiy Butenko (obutenko)]

verified on MOS 7.0 ISO 265
{"build_id": "265", "build_number": "265", "release_versions": {"2015.1.0-7.0": {"VERSION": {"build_id": "265", "build_number": "265", "api": "1.0", "fuel-library_sha": "4fdf3d6b070204366593012428395d173698678a", "nailgun_sha": "0dfcf73deb8ae99654f3da2ea95b7b68b9ee7273", "feature_groups": ["mirantis"], "fuel-nailgun-agent_sha": "d7027952870a35db8dc52f185bb1158cdd3d1ebd", "openstack_version": "2015.1.0-7.0", "fuel-agent_sha": "082a47bf014002e515001be05f99040437281a2d", "production": "docker", "python-fuelclient_sha": "9643fa07f1290071511066804f962f62fe27b512", "astute_sha": "e63709d16bd4c1949bef820ac336c9393c040d25", "fuel-ostf_sha": "582a81ccaa1e439a3aec4b8b8f6994735de840f4", "release": "7.0", "fuelmain_sha": "9ab01caf960013dc882825dc9b0e11ccf0b81cb0"}}}, "auth_required": true, "api": "1.0", "fuel-library_sha": "4fdf3d6b070204366593012428395d173698678a", "nailgun_sha": "0dfcf73deb8ae99654f3da2ea95b7b68b9ee7273", "feature_groups": ["mirantis"], "fuel-nailgun-agent_sha": "d7027952870a35db8dc52f185bb1158cdd3d1ebd", "openstack_version": "2015.1.0-7.0", "fuel-agent_sha": "082a47bf014002e515001be05f99040437281a2d", "production": "docker", "python-fuelclient_sha": "9643fa07f1290071511066804f962f62fe27b512", "astute_sha": "e63709d16bd4c1949bef820ac336c9393c040d25", "fuel-ostf_sha": "582a81ccaa1e439a3aec4b8b8f6994735de840f4", "release": "7.0", "fuelmain_sha": "9ab01caf960013dc882825dc9b0e11ccf0b81cb0"}