CVE-2013-2030
Low
Description
keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora.
SeverityLow
CVSS2.1
Exploit probability—
ProductOpenstack Folsom
PublishedDec 27, 2013
First seenDec 27, 2013
How to fix
Update
- python-keystoneclient0.2.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openstack folsom | No range specified | — |
| openstack compute | 2013.1, 2013.1.1, 2013.1.2, 2013.1.3 | — |
| openstack grizzly | 2013.1 | — |
| openstack havana | havana-1, havana-2, havana-3 | — |
| python-keystoneclientPyPI | v < 0.2.4 | 0.2.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.