CVE-2013-4477

Priority
Medium
Description
The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when
removing a role on a tenant for a user who does not have that role, adds
the role to the user, which allows local users to gain privileges.
References
Bugs
Assigned-to
jdstrand
Package
Upstream:released (2013.2-2)
Ubuntu 10.04 LTS (Lucid Lynx):DNE
Ubuntu 12.04 LTS (Precise Pangolin):not-affected (code-not-present)
Ubuntu 12.10 (Quantal Quetzal):released (2012.2.4-0ubuntu3.3)
Ubuntu 13.04 (Raring Ringtail):released (1:2013.1.4-0ubuntu1.1)
Ubuntu 13.10 (Saucy Salamander):released (1:2013.2-0ubuntu1.1)
Ubuntu 14.04 LTS (Trusty Tahr):not-affected (1:2013.2-0ubuntu1.1)
Patches:
Upstream:https://review.openstack.org/53154 (grizzly)
Upstream:https://review.openstack.org/53146 (havana)
More Information

Valid XHTML 1.0 Strict

Updated: 2013-11-25 21:14:34 UTC (commit 7483)