Security weakness related to memcached

[Carmen Rata]

Brief Description
-----------------

Memcached security weakness allows for acquiring a keystone token and use it to get access to StaringX web access as sysadmin.

At controller (localhost), one can obtain a token by dumping memcached with memcached_dump.
External host can get the token by accessing the Host IP and port.
The container of the host can also get token by accessing it's host IP and port (w/o root privileges).

Severity
--------

Major

Steps to Reproduce
------------------

1. use "memcached_dump" to obtain the authentication token.
2. access StaringX web with the token

Expected Behavior
------------------

Authentication token should not be exposed in clear text. It should be encrypted or not accessible.

Actual Behavior
----------------

Authentication token should is exposed

Reproducibility
---------------

<Reproducible/Intermittent/Seen once>

not 100% reproducible, some servers have the issue, some do not

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/stx-puppet/+/902309

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/config/+/902860