OpenStack Security Advisory

  1. Bug #1282865
  2. Comment #1

Comment 1 for bug 1282865

Revision history for this message
Kieran Spear (kspear) wrote : Re: Glance-registry context leak

auth_token middleware thinks it is retrieving the user's token from memcache, but ends up returning the token data for the admin user:

2014-02-21 16:41:56.868 28193 DEBUG keystoneclient.middleware.auth_token [-] Returning cached token 46b4e15e0bf1bef6655dbee733867972. Token data:
{u'access': {u'token': {u'issued_at': u'2014-02-21T05:41:51.816330', u'expires': u'2014-02-21T11:41:51Z', u'id': u'placeholder', u'tenant': {u'id': u'e4eee8dbc16a49dcbc76edac96674e96', u'enabled': True, u'description': None, u'name': u'admin'}}

46b4e15e0bf1bef6655dbee733867972 is the hash of the user's PKI token. But the token data is from another user's token!