python-keystoneclient

  1. Bug #1282865
  2. Comment #21

Comment 21 for bug 1282865

Revision history for this message
Tristan Cacqueray (tristan-cacqueray) wrote : Re: Keystone middleware may confuse contexts

Agree, this bug deserve much attention!

Draft impact description #4 -

Title: Potential context confusion in Keystone middleware
Reporter: Kieran Spear (University of Melbourne)
Products: python-keystoneclient
Versions: All versions up to 0.6.0

Description:
Kieran Spear from the University of Melbourne reported a vulnerability in Keystone auth_token middleware (shipped in python-keystoneclient). By doing repeated requests, with sufficient load on the target system, an authenticated user may in certain situations assume another authenticated user's complete identity and multi-tenant authorizations, potentially resulting in a privilege escalation. Note that it is related to a bad interaction between eventlet and python-memcached that should be avoided if the calling process already monkey-patches "thread" to use eventlet. Only keystone middleware setups using auth_token with memcache are vulnerable.