CVE-2014-0105

描述

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

如何修補 CVE-2014-0105

要修補 CVE-2014-0105,請將受影響套件升級到下列已修補版本。

• —升級至 2013.1.1-2 或更新版本
• —升級至 1:0.6.0-4 或更新版本
• —升級至 0.7.0 或更新版本
• —升級至 0.7.0 或更新版本

CVE-2014-0105 正在被利用嗎?

低 — EPSS 為 1.1%,目前沒有觀察到大規模利用活動。

受影響套件(4)

• from 0, < 2013.1.1-2
• from 0, < 1:0.6.0-4
• from 0, < 0.7.0
• from 0, < 0.7.0

CVSS 分數

參考連結(10)

• ADVISORYgithub.com/advisories/GHSA-gwvq-rgqf-993f
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2014-0105
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2014-0105
• PATCHgithub.com/openstack/python-keystoneclient
• WEB