OpenStack python-keystoneclient CVE-2014-0105 Privilage Escalation Vulnerability

Bugtraq ID:	66494
Class:	Design Error
CVE:	CVE-2014-0105
Remote:	Yes
Local:	No
Published:	Feb 21 2014 12:00AM
Updated:	Apr 13 2015 08:26PM
Credit:	Kieran Spear
Vulnerable:
Not Vulnerable:

OpenStack python-keystoneclient CVE-2014-0105 Privilage Escalation Vulnerability

python-keystoneclient is prone to a privilege-escalation vulnerability.

Successful exploits may allow authenticated attackers to gain escalated privileges and perform unauthorized actions which may aid in launching further attacks.

python-keystoneclient 0.2.3 up to 0.6.0 are vulnerable.

OpenStack python-keystoneclient CVE-2014-0105 Privilage Escalation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

OpenStack python-keystoneclient CVE-2014-0105 Privilage Escalation Vulnerability

References:

• Change Iffb1d1bf: add pooling for cache references (OpenStack)
  
• OpenStack Keystone Homepage (OpenStack )
  
• [OSSA 2014-007] Keystone middleware may confuse contexts (CVE-2014-0105) (LaunchPad)
  
• Security Bulletin: IBM SmartCloud Orchestrator - Potential context confusion in (IBM)