CVE-2013-2157

Publication date 13 June 2013

Last updated 24 July 2024

Ubuntu priority

OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
keystone	13.04 raring	Fixed 1:2013.1.1-0ubuntu2.1
	12.10 quantal	Fixed 2012.2.4-0ubuntu3.1
	12.04 LTS precise	Not affected
	10.04 LTS lucid	Not in release

Notes

seth-arnold

patches in Message-ID: <[email protected]>

12.04 LTS does not have 0d32a417c811ce37b1b7ea1fbbc0a8376b9b3723 which is required to be exposed to this bug (ie anonymous binds fail without it) If 0d32a417c811ce37b1b7ea1fbbc0a8376b9b3723 is applied then the patch for folsom will work with some light modifications.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
keystone	Upstream: https://review.openstack.org/gitweb?p=openstack%2Fkeystone.git;a=commitdiff;h=35eb7bbc0d28721122c25a64ab687af23ecf6000 Upstream: https://review.openstack.org/gitweb?p=openstack%2Fkeystone.git;a=commitdiff;h=c100fd2f1fe024cb2f731bfdd283cee36259e6e3

CVE-2013-2157

Status

Notes

seth-arnold

jdstrand

Patch details

References

Related Ubuntu Security Notices (USN)

Other references