-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCgAGBQJSs33xAAoJEFHb3FjMVZVzC+AQAI7ux3tSOBc45gRdKu+MT6Bb
JgzjArN+wDGHvrdYC8WwTCPdoDGs/dPhnsd9TXInRBMnYwePa52P/Wa0TjRvKFks
GyUR7nOjM8/fCfmb/fhpTzaPfWSY2stVSAQ6OBc+aAh7zrj6PuZpTX2fnloNBjli
Bi1aWqpuEomzf65DGoNr+vckl+9s7B63bRnN457QEfH6srVT/l4DGY8A9yeOvZdH
vpcCGyxfqHirolIssoyR0R2OYpBtrcJ15734bmqWy3jGHSZcIddFk3nV3caq+9MF
/emtn9a/88FJ5lpg7bGETbSe8JiafkdX8eJJ28QnyTKRyKjHSasaUTAh5HgdwF3p
+7MiI089mOcaMn6kFLthLDK3vViJJ56y0QBJOf3155AfnRJYFyPr7ZdRyNhB3L8r
5B8QThy2mQXaEr7XXcjoMwoQxFuODVeCyehIRf32dxyPUQD02pju6eaKVUTnPCS9
a8M8jr2LVRce3NBPSonqznnpyHRYPX4Mf4JHgz6DQqPT+w9UtCY+hNbrklDxnlLj
crGym+SqRpFdpU5gk8ukEMXmtrCqLLNarLsXkVYUFIY512HmtXtsOFAd6GXG1p0C
j1BudGAOV82ymCOkv31qJXTM9su4jxQPZHaQizflHNrQz3Ec75ValHlAu17VESSD
WCmCPB4qtDQOSilmBaL6
=d8en
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2061-1
December 19, 2013
keystone vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 13.10
Summary:
Keystone access controls could be circumvented via EC2-style tokens.
Software Description:
- keystone: OpenStack identity service
Details:
Steven Hardy discovered that Keystone did not properly enforce trusts when
using the ec2tokens API. An authenticated attacker could exploit this to
retrieve a token not scoped to the trust and elevate privileges to the
trustor's roles.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 13.10:
python-keystone 1:2013.2-0ubuntu1.2
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2061-1
CVE-2013-6391
Package Information:
https://launchpad.net/ubuntu/+source/keystone/1:2013.2-0ubuntu1.2
No comments:
Post a Comment