OpenStack Security Advisory

  1. Bug #1324592
  2. Comment #16

Comment 16 for bug 1324592

Revision history for this message
Morgan Fainberg (mdrnstm) wrote : Re: Trust scope can be circumvented by chaining trusts

This patch will require minor differences for stable/icehouse:

nullptr:keystone morgan$ git apply --reject patch
Checking patch keystone/common/authorization.py...
Hunk #1 succeeded at 87 (offset 19 lines).
Hunk #2 succeeded at 123 (offset 19 lines).
Checking patch keystone/contrib/oauth1/controllers.py...
Checking patch keystone/tests/test_v3_auth.py...
Hunk #1 succeeded at 2777 (offset -50 lines).
Checking patch keystone/tests/test_v3_oauth1.py...
Hunk #1 succeeded at 486 (offset 10 lines).
Checking patch keystone/trust/controllers.py...
error: while searching for:
        The user creating the trust must be the trustor.

        """
        if not trust:
            raise exception.ValidationError(attribute='trust',
                                            target='request')

error: patch failed: keystone/trust/controllers.py:124
Applied patch keystone/common/authorization.py cleanly.
Applied patch keystone/contrib/oauth1/controllers.py cleanly.
Applied patch keystone/tests/test_v3_auth.py cleanly.
Applied patch keystone/tests/test_v3_oauth1.py cleanly.
Applying patch keystone/trust/controllers.py with 1 reject...
Rejected hunk #1