OpenStack Identity (keystone)

memcache driver needs protection against unicode user keys

Series essex
Bug #1056373

Bug #1056373 reported by Dolph Mathews on 2012-09-25

This bug affects 1 person

	Status	Importance	Assigned to	Milestone
OpenStack Identity (keystone)	Fix Released	Critical	Dolph Mathews	OpenStack Identity (keystone) 2012.2 "folsom"
Essex	Fix Released	Critical	Joseph Heck	OpenStack Identity (keystone) 2012.1.3
keystone (Ubuntu)	Fix Released	Undecided	Unassigned
Precise	Fix Released	Undecided	Unassigned

Bug Description

Based on feedback from bug 1046905: https://bugs.launchpad.net/keystone/+bug/1046905/comments/5

Specifically, if you try to read/write to memcache using a unicode key, you get a memcache.MemcachedStringEncodingError. This specific scenarios is described in the above comment:

    >>> import memcache
    >>> import uuid
    >>> memcache.Client(['localhost:11211']).get('usertokens-%s' % unicode(uuid.uuid4().hex))
    Traceback (most recent call last):
      File "<stdin>", line 1, in <module>
      File "/home/dolph/Environments/os/local/lib/python2.7/site-packages/memcache.py", line 862, in get
        return self._get('get', key)
      File "/home/dolph/Environments/os/local/lib/python2.7/site-packages/memcache.py", line 813, in _get
        self.check_key(key)
      File "/home/dolph/Environments/os/local/lib/python2.7/site-packages/memcache.py", line 1014, in check_key
        "Keys must be str()'s, not unicode. Convert your unicode "
    memcache.MemcachedStringEncodingError: Keys must be str()'s, not unicode. Convert your unicode strings using mystring.encode(charset)!

Tags:

Related branches

lp://staging/~openstack-ubuntu-testing/keystone/precise-essex-proposed

Merged into lp://staging/~ubuntu-server-dev/keystone/essex at revision 100

Ubuntu Server Developers: Pending requested 2012-03-16

lp://staging/~yolanda.robla/ubuntu/precise/keystone/essex-sru

Merged into lp://staging/ubuntu/precise-updates/keystone

James Page: Approve on 2012-12-18

lp://staging/ubuntu/precise-proposed/keystone

CVE References

Joseph Heck (heckj) on 2012-09-25

Changed in keystone:
status:	New → Triaged
importance:	Undecided → Critical
assignee:	nobody → Dolph Mathews (dolph)

Joseph Heck (heckj) on 2012-09-25

no longer affects:

keystone/folsom

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2012-09-25: Fix proposed to keystone (master)

Fix proposed to branch: master
Review: https://review.openstack.org/13652

Changed in keystone:
status:	Triaged → In Progress

Joseph Heck (heckj) on 2012-09-25

tags:	added: essex
tags:	added: essex-backport

Thierry Carrez (ttx) on 2012-09-25

Changed in keystone:
milestone:	none → folsom-rc2

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2012-09-25: Fix proposed to keystone (milestone-proposed)

Fix proposed to branch: milestone-proposed
Review: https://review.openstack.org/13667

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2012-09-25: Fix merged to keystone (master)

Reviewed: https://review.openstack.org/13652
Committed: http://github.com/openstack/keystone/commit/431e50a7851d2e7dbb212d02647faeb958ed21e8
Submitter: Jenkins
Branch: master

commit 431e50a7851d2e7dbb212d02647faeb958ed21e8
Author: Dolph Mathews <email address hidden>
Date: Tue Sep 25 19:04:50 2012 +0000

utf-8 encode user keys in memcache (bug 1056373)

Change-Id: I026dd4282742213e69c7aa02e109439b07a73c8e

Changed in keystone:
status:	In Progress → Fix Committed

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2012-09-25: Fix proposed to keystone (stable/essex)

Fix proposed to branch: stable/essex
Review: https://review.openstack.org/13670

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2012-09-26: Fix merged to keystone (milestone-proposed)

Reviewed: https://review.openstack.org/13667
Committed: http://github.com/openstack/keystone/commit/8154492da3d8b6e0e71eb7dcb5e2e3b06ddb09a7
Submitter: Jenkins
Branch: milestone-proposed

commit 8154492da3d8b6e0e71eb7dcb5e2e3b06ddb09a7
Author: Dolph Mathews <email address hidden>
Date: Tue Sep 25 19:04:50 2012 +0000

utf-8 encode user keys in memcache (bug 1056373)

Change-Id: I026dd4282742213e69c7aa02e109439b07a73c8e
(cherry picked from commit 431e50a7851d2e7dbb212d02647faeb958ed21e8)

Changed in keystone:
status:	Fix Committed → Fix Released

Dolph Mathews (dolph) on 2012-09-26

summary:

- memcache driver needs protection against non-string keys
+ memcache driver needs protection against unicode user keys

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2012-09-26: Fix proposed to keystone (stable/essex)

Fix proposed to branch: stable/essex
Review: https://review.openstack.org/13718

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2012-09-26: Fix merged to keystone (stable/essex)

Reviewed: https://review.openstack.org/13718
Committed: http://github.com/openstack/keystone/commit/0e1f05e7a851f5fb72742e4d3e4978d76fe23b55
Submitter: Jenkins
Branch: stable/essex

commit 0e1f05e7a851f5fb72742e4d3e4978d76fe23b55
Author: Dolph Mathews <email address hidden>
Date: Tue Sep 25 19:04:50 2012 +0000

utf-8 encode user keys in memcache (bug 1056373)

(cherry picked from commit 431e50a7851d2e7dbb212d02647faeb958ed21e8)

Change-Id: I026dd4282742213e69c7aa02e109439b07a73c8e

Thierry Carrez (ttx) on 2012-09-27

Changed in keystone:
milestone:	folsom-rc2 → 2012.2

Yolanda Robla (yolanda.robla) on 2012-12-11

Changed in keystone (Ubuntu):
status:	New → Fix Released

Adam Gandelman (gandelman-a) on 2012-12-12

Changed in keystone (Ubuntu Precise):
status:	New → Confirmed

Revision history for this message

Brian Murray (brian-murray) wrote on 2013-05-09: Please test proposed package

Hello Dolph, or anyone else affected,

Accepted keystone into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/keystone/2012.1.3+stable-20130423-f48dd0fc-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in keystone (Ubuntu Precise):
status:	Confirmed → Fix Committed
tags:	added: verification-needed

Revision history for this message

Yolanda Robla (yolanda.robla) wrote on 2013-05-16: Verification report.

Please find the attached test log from the Ubuntu Server Team's CI infrastructure. As part of the verification process for this bug, Keystone has been deployed and configured across multiple nodes using precise-proposed as an installation source. After successful bring-up and configuration of the cluster, a number of exercises and smoke tests have be invoked to ensure the updated package did not introduce any regressions. A number of test iterations were carried out to catch any possible transient errors.

Please Note the list of installed packages at the top and bottom of the report.

For records of upstream test coverage of this update, please see the Jenkins links in the comments of the relevant upstream code-review(s):

Trunk review: https://review.openstack.org/13652
Stable review: https://review.openstack.org/13718

As per the provisional Micro Release Exception granted to this package by the Technical Board, we hope this contributes toward verification of this update.

Revision history for this message

Yolanda Robla (yolanda.robla) wrote on 2013-05-16:

#10

2012.1.3+stable-20130423-f48dd0fc-0ubuntu1.log Edit (111.3 KiB, text/plain)

Test coverage log.

tags:

added: verification-done
removed: verification-needed

Revision history for this message

Scott Kitterman (kitterman) wrote on 2013-05-16: Update Released

#11

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

Revision history for this message

Launchpad Janitor (janitor) wrote on 2013-05-16:

#12

This bug was fixed in the package keystone - 2012.1.3+stable-20130423-f48dd0fc-0ubuntu1

---------------
keystone (2012.1.3+stable-20130423-f48dd0fc-0ubuntu1) precise-proposed; urgency=low

  * Resynchronize with stable/essex (LP: #1089488):
    - [7402f5e] EC2 authentication does not ensure user or tenant is enabled
      LP: 1121494
    - [8945567] DoS through XML entity expansion (CVE-2013-1664) LP: 1100282
    - [7b5b72f] Add size validations for /tokens.
    - [ef1e682] docutils 0.10 incompatible with sphinx 1.1.3 LP: 1091333
    - [8735009] Removing user from a tenant isn't invalidating user access to
      tenant (LP: #1064914)
    - [025b1d5] Jenkins jobs fail because of incompatibility between sqlalchemy-
      migrate and the newest sqlalchemy-0.8.0b1 (LP: #1073569)
    - [ddb4019] Open 2012.1.4 development
    - [0e1f05e] memcache driver needs protection against unicode user keys
      (LP: #1056373)
    - [176ee9b] Token invalidation in case of role grant/revoke should be
      limited to affected tenant (LP: #1050025)
    - [58ac669] Token validation includes revoked roles (CVE-2012-4413)
      (LP: #1041396)
    - [cd1e48a] Memcached Token Backend does not support list tokens
      (LP: #1046905)
    - [5438d3b] Update user's default tenant partially succeeds without authz
      (LP: #1040626)
  * Dropped patches, superseeded by new snapshot:
    - debian/patches/CVE-2013-0282.patch [7402f5e]
    - debian/patches/CVE-2013-1664+1665.patch [8945567]
    - debian/patches/keystone-CVE-2012-5571.patch [8735009]
    - debian/patches/keystone-CVE-2012-4413.patch [58ac669]
    - debian/patches/keystone-CVE-2012-3542.patch [5438d3b]
  * Refreshed patches:
    - debian/patches/CVE-2013-0247.patch
    - debian/patches/fix-ubuntu-tests.patch
-- Yolanda <email address hidden> Tue, 23 Apr 2013 10:30:16 +0200