PT-2013-3512 · Openstack · Openstack Nova

Published 2013-12-27 · Updated 2022-05-17 · CVE-2013-2030

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Nova versions Folsom through Havana

Description The issue is related to the use of an insecure temporary directory for storing signing certificates in the keystone/middleware/auth token.py module. This allows local users to potentially spoof servers by pre-creating the directory, which is then reused by Nova. An example of this exploit is demonstrated on Fedora using the /tmp/keystone-signing-nova directory.

Recommendations For OpenStack Nova versions Folsom through Havana, consider restricting access to the temporary directory used for storing signing certificates to prevent local users from spoofing servers. As a temporary workaround, restrict access to the /tmp/keystone-signing-nova directory to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

CWE-1188

Related Identifiers

CVE-2013-2030

GHSA-PXXV-RV32-2QGV

Affected Products

Openstack Nova

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2013-2030 · Security Note
• http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pxxv-rv32-2qgv · Vendor Advisory
• https://github.com/openstack/nova · Note
• https://github.com/openstack/nova/commit/74aa04e2ca7942cb1e1a86dcbaffeb72d260ccd7 · Note
• https://github.com/openstack/nova/commit/7bf3e8d3e254d817ff5ae7ef1f2884b10410ca60 · Note
• https://github.com/openstack/nova/commit/58d6879b1caaa750c39c8e452a0634c24ffef2ce · Note
• https://github.com/openstack/python-keystoneclient/commit/1736e2ffb12f70eeebed019448bc14def48aa036 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2013-45.yaml · Note
• https://bugs.launchpad.net/nova/+bug/1174608 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=958285 · Note
• http://openwall.com/lists/oss-security/2013/05/09/2 · Note