OpenStack Security Advisory

  1. Bug #1282865
  2. Comment #34

Comment 34 for bug 1282865

Revision history for this message
Brant Knudson (blk-u) wrote : Re: Keystone middleware may confuse contexts (CVE-2014-0105)

I think we need to come to an agreement on the approach to take, and then we can implement it. I think the approach to take is to both:

a) change auth_token to fail if it's configured for memcached and it's running in eventlet and 'thread' isn't monkey-patched.
b) eventlet servers that use auth_token are changed to monkey-patch eventlet 'thread' in addition to their other monkey-patching.