==========================================================================
Ubuntu Security Notice USN-2406-1
November 11, 2014

keystone vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 14.04 LTS

Summary:

OpenStack Keystone could be made to expose sensitive information over the
network.

Software Description:
– keystone: OpenStack identity service

Details:

Brant Knudson discovered that OpenStack Keystone did not properly perform
input sanitization when performing endpoint catalog substitution. A remote
attacker with privileged access for creating endpoints could exploit this
to obtain sensitive information.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
python-keystone 1:2014.1.3-0ubuntu2.1

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2406-1
CVE-2014-3621

Package Information:
https://launchpad.net/ubuntu/+source/keystone/1:2014.1.3-0ubuntu2.1

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJUYmNqAAoJEFHb3FjMVZVzBd8P/1RNYODNzPh71QNqTLkM0foK
2vaWPw6zwgzz3uEf+jWZ7Yp5oLNo6Bd6/EHMgOxjOEm0fGtgNWm8he9PNuTyEM8Q
grFLXO8D3eMEub4mZ4+j1tPqI9VDkQLMUtRBeBkdB9IgMyMfO3cogpd9xNDVza3R
sLq5Kyhc9lpFlkR/cmfecCiRV50YX06ziWuCEJmaKHlWk9XeeMkOV68lKmsILZ3L
sLlN/EHpDhx9R30qDLXOdr4fx2ULlw14tz3LcXYpa1+c+Gsd8oE1ZDgO7ES+zp+F
D9lAnkzYbPy/1X/KiPNnGxIMFCNkUdzpoIJK1+hrCttflZL6esV1vNhTGjbQtIlP
gRWlYgZj6k8OdDXts0NCgL73/MvoFhy21FhTRIVfUGtKR90uwW3X9s8ZLx3nhfDQ
ae7YgYO1bqg8KS72SbbpH1RSpf4p9ROl+aK5qTe3kUhvp77ITizb38VjK2ycYFym
v+Tv50Bo/VdYqAiPCmTenWC92xIFO/FazO7XQdVXA3ypa7JaxYB3qs1hVGzPGb9x
e8Zn54nHZUF+K3SD5bjDHr1iucrpF2ohSXdwgVhOIlTcLA51hU9006gQppwev3kd
Gp+ppDiRgGR9LG5w0kdjlsT/UYsWeFGsguZYefazUs/XKy4dvNowcAYnkn6yAf5r
eiKqFa7FKyyG8ceRz8lw
=qCLB
—–END PGP SIGNATURE—–
—