CVE-2013-2167

Related Files

Red Hat Security Advisory 2013-0992-01

Posted Jun 27, 2013

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0992-01 - Python-keystoneclient is the client library and command line utility for interacting with the OpenStack identity API. A flaw was found in the way python-keystoneclient handled encrypted data from memcached. Even when the memcache_security_strategy setting in "/etc/swift/proxy-server.conf" was set to ENCRYPT to help prevent tampering, an attacker on the local network, or possibly an unprivileged user in a virtual machine hosted on OpenStack, could use this flaw to bypass intended restrictions and modify data in memcached that will later be used by services utilizing python-keystoneclient.

tags | advisory, local, python

systems | linux, redhat

advisories | CVE-2013-2166, CVE-2013-2167

SHA-256 | 0b46ee70e661aac86fcfce7d4bfb6636c8819246323ca5bac1086eda68288cae

Download | Favorite | View