prometheanfire 14/04/11 15:28:59 Added: CVE-2014-2828-2013.2.3.patch Log: fix for CVE-2014-2828 (Portage version: 2.2.8-r1/cvs/Linux x86_64, signed Manifest commit with key 0x2471eb3e40ac5ac3)
Revision Changes Path 1.1 sys-auth/keystone/files/CVE-2014-2828-2013.2.3.patch file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sys-auth/keystone/files/CVE-2014-2828-2013.2.3.patch?rev=1.1&view=markup plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sys-auth/keystone/files/CVE-2014-2828-2013.2.3.patch?rev=1.1&content-type=text/plain Index: CVE-2014-2828-2013.2.3.patch =================================================================== >From e364ba5b12de8e4c11bd80bcca903f9615dcfc2e Mon Sep 17 00:00:00 2001 From: Florent Flament <florent.flament-...@cloudwatt.com> Date: Tue, 1 Apr 2014 12:48:22 +0000 Subject: [PATCH] Sanitizes authentication methods received in requests. When a user authenticates against Identity V3 API, he can specify multiple authentication methods. This patch removes duplicates, which could have been used to achieve DoS attacks. Closes-Bug: 1300274 (cherry picked from commit ef868ad92c00e23a4a5e9eb71e3e0bf5ae2fff0c) Cherry-pick from https://review.openstack.org/#/c/84425/ Change-Id: I6e60324309baa094a5e54b012fb0fc528fea72ab --- keystone/auth/controllers.py | 8 +++++++- keystone/tests/test_v3_auth.py | 12 ++++++++++++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/keystone/auth/controllers.py b/keystone/auth/controllers.py index c3399df..4944316 100644 --- a/keystone/auth/controllers.py +++ b/keystone/auth/controllers.py @@ -225,7 +225,13 @@ def get_method_names(self): :returns: list of auth method names """ - return self.auth['identity']['methods'] or [] + # Sanitizes methods received in request's body + # Filters out duplicates, while keeping elements' order. + method_names = [] + for method in self.auth['identity']['methods']: + if method not in method_names: + method_names.append(method) + return method_names def get_method_data(self, method): """Get the auth method payload. diff --git a/keystone/tests/test_v3_auth.py b/keystone/tests/test_v3_auth.py index d07e6ae..e89e29f 100644 --- a/keystone/tests/test_v3_auth.py +++ b/keystone/tests/test_v3_auth.py @@ -81,6 +81,18 @@ def test_both_project_and_domain_in_scope(self): None, auth_data) + def test_get_method_names_duplicates(self): + auth_data = self.build_authentication_request( + token='test', + user_id='test', + password='test')['auth'] + auth_data['identity']['methods'] = ['password', 'token', + 'password', 'password'] + context = None + auth_info = auth.controllers.AuthInfo(context, auth_data) + self.assertEqual(auth_info.get_method_names(), + ['password', 'token']) + def test_get_method_data_invalid_method(self): auth_data = self.build_authentication_request( user_id='test', -- 1.9.1
