VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Dec 27, 2013· Updated Apr 29, 2026

CVE-2013-2030

CVE-2013-2030

Description

keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
python-keystoneclientPyPI
< 0.2.40.2.4

Affected products

9
  • OpenStack/Compute4 versions
    cpe:2.3:a:openstack:compute:2013.1:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:openstack:compute:2013.1:*:*:*:*:*:*:*
    • cpe:2.3:a:openstack:compute:2013.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:openstack:compute:2013.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:openstack:compute:2013.1.3:*:*:*:*:*:*:*
  • OpenStack/Folsom
    cpe:2.3:a:openstack:folsom:-:*:*:*:*:*:*:*
  • OpenStack/Grizzly
    cpe:2.3:a:openstack:grizzly:2013.1:*:*:*:*:*:*:*
  • OpenStack/Havana3 versions
    cpe:2.3:a:openstack:havana:havana-1:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:openstack:havana:havana-1:*:*:*:*:*:*:*
    • cpe:2.3:a:openstack:havana:havana-2:*:*:*:*:*:*:*
    • cpe:2.3:a:openstack:havana:havana-3:*:*:*:*:*:*:*

Patches

4
1736e2ffb12f

Securely create signing_dir (bug 1174608)

https://github.com/openstack/python-keystoneclientDolph MathewsMay 8, 2013via ghsa
commit
1 file changed · +14 −9
  • keystoneclient/middleware/auth_token.py+14 −9 modified
    @@ -296,15 +296,20 @@ def __init__(self, app, conf):
         self.signing_dirname = self._conf_get('signing_dir')
         self.LOG.info('Using %s as cache directory for signing certificate' %
                       self.signing_dirname)
-        if (os.path.exists(self.signing_dirname) and
-                not os.access(self.signing_dirname, os.W_OK)):
-                raise ConfigurationError("unable to access signing dir %s" %
-                                         self.signing_dirname)
-
-        if not os.path.exists(self.signing_dirname):
-            os.makedirs(self.signing_dirname)
-        #will throw IOError  if it cannot change permissions
-        os.chmod(self.signing_dirname, stat.S_IRWXU)
+        if os.path.exists(self.signing_dirname):
+            if not os.access(self.signing_dirname, os.W_OK):
+                raise ConfigurationError(
+                    'unable to access signing_dir %s' % self.signing_dirname)
+            if os.stat(self.signing_dirname).st_uid != os.getuid():
+                self.LOG.warning(
+                    'signing_dir is not owned by %s' % os.getlogin())
+            current_mode = stat.S_IMODE(os.stat(self.signing_dirname).st_mode)
+            if current_mode != stat.S_IRWXU:
+                self.LOG.warning(
+                    'signing_dir mode is %s instead of %s' %
+                    (oct(current_mode), oct(stat.S_IRWXU)))
+        else:
+            os.makedirs(self.signing_dirname, stat.S_IRWXU)
 
         val = '%s/signing_cert.pem' % self.signing_dirname
         self.signing_cert_file_name = val
74aa04e2ca79

Remove insecure default for signing_dir option.

https://github.com/openstack/novaRussell BryantMay 1, 2013via ghsa
commit
1 file changed · +4 −1
  • etc/nova/api-paste.ini+4 −1 modified
    @@ -124,4 +124,7 @@ auth_protocol = http
 admin_tenant_name = %SERVICE_TENANT_NAME%
 admin_user = %SERVICE_USER%
 admin_password = %SERVICE_PASSWORD%
-signing_dir = /tmp/keystone-signing-nova
+# signing_dir is configurable, but the default behavior of the authtoken
+# middleware should be sufficient.  It will create a temporary directory
+# in the home directory for the user the nova process is running as.
+#signing_dir = /var/lib/nova/keystone-signing
7bf3e8d3e254

Remove insecure default for signing_dir option.

https://github.com/openstack/novaRussell BryantMay 1, 2013via ghsa
commit
1 file changed · +4 −1
  • etc/nova/api-paste.ini+4 −1 modified
    @@ -104,6 +104,9 @@ auth_protocol = http
 admin_tenant_name = %SERVICE_TENANT_NAME%
 admin_user = %SERVICE_USER%
 admin_password = %SERVICE_PASSWORD%
-signing_dir = /tmp/keystone-signing-nova
+# signing_dir is configurable, but the default behavior of the authtoken
+# middleware should be sufficient.  It will create a temporary directory
+# in the home directory for the user the nova process is running as.
+#signing_dir = /var/lib/nova/keystone-signing
 # Workaround for https://bugs.launchpad.net/nova/+bug/1154809
 auth_version = v2.0
58d6879b1caa

Remove insecure default for signing_dir option.

https://github.com/openstack/novaRussell BryantMay 1, 2013via ghsa
commit
1 file changed · +4 −1
  • etc/nova/api-paste.ini+4 −1 modified
    @@ -104,6 +104,9 @@ auth_protocol = http
 admin_tenant_name = %SERVICE_TENANT_NAME%
 admin_user = %SERVICE_USER%
 admin_password = %SERVICE_PASSWORD%
-signing_dir = /tmp/keystone-signing-nova
+# signing_dir is configurable, but the default behavior of the authtoken
+# middleware should be sufficient.  It will create a temporary directory
+# in the home directory for the user the nova process is running as.
+#signing_dir = /var/lib/nova/keystone-signing
 # Workaround for https://bugs.launchpad.net/nova/+bug/1154809
 auth_version = v2.0

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

12

News mentions

0

No linked articles in our index yet.