CVE-2013-2030

Published: Dec 27, 2013Modified: Apr 29, 2026

2.1

Vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 3.9 / Impact: 2.9

Source: NVD

Description

keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora.

Affected (9)

Products: Openstack: Compute, Folsom, Grizzly, Havana

4 products

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Openstack Compute	Version 2013.1.1
Openstack Compute	Version 2013.1.2
Openstack Compute	Version 2013.1.3
Openstack Compute	Version 2013.1
Openstack Folsom	All versions
Openstack Grizzly	Version 2013.1
Openstack Havana	Version havana-1
Openstack Havana	Version havana-2
Openstack Havana	Version havana-3

Related CWEs

References (10)

http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html

Source: secalert@redhat.com

http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.html

Source: secalert@redhat.com

PatchVendor Advisory

http://www.openwall.com/lists/oss-security/2013/05/09/2

Source: secalert@redhat.com

https://bugs.launchpad.net/nova/+bug/1174608

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=958285

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.openwall.com/lists/oss-security/2013/05/09/2

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugs.launchpad.net/nova/+bug/1174608

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=958285

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.