[SECURITY] Fedora 19 Update: python-keystoneclient-0.2.3-7.fc19
updates at fedoraproject.org
updates at fedoraproject.org
Thu Aug 15 02:35:03 UTC 2013
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2013-14302
2013-08-06 22:03:19
--------------------------------------------------------------------------------
Name : python-keystoneclient
Product : Fedora 19
Version : 0.2.3
Release : 7.fc19
URL : http://pypi.python.org/pypi/python-keystoneclient
Summary : Client library for OpenStack Identity API
Description :
Client library and command line utility for interacting with Openstack
Identity API.
--------------------------------------------------------------------------------
Update Information:
Selective backports from stable/grizzly:
* Ec2Signer: Initial support for v4 signature verification.
* Allow signature verification for older boto versions.
* Default signing_dir to secure temp dir.
* Fix memcache encryption middleware. (CVE-2013-2166, CVE-2013-2167)
* Check token expiry. (CVE-2013-2104)
* Allow secure user password update. (CVE-2013-2013)
--------------------------------------------------------------------------------
ChangeLog:
* Mon Aug 5 2013 Jakub Ruzicka <jruzicka at redhat.com> 0.2.3-7
- Ec2Signer: Allow signature verification for older boto versions. (#984752)
* Mon Jul 29 2013 Jakub Ruzicka <jruzicka at redhat.com> 0.2.3-6
- Allow secure user password update. (CVE-2013-2013)
* Thu Jul 25 2013 Jakub Ruzicka <jruzicka at redhat.com> 0.2.3-5
- Ec2Signer: Initial support for v4 signature verification.
- Default signing_dir to secure temp dir.
- Fix memcache encryption middleware. (CVE-2013-2166, CVE-2013-2167)
* Tue May 28 2013 Jakub Ruzicka <jruzicka at redhat.com> 0.2.3-4
- Check token expiry. (CVE-2013-2104)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #974271 - CVE-2013-2166 CVE-2013-2167 python-keystoneclient: middleware memcache encryption and signing bypass
https://bugzilla.redhat.com/show_bug.cgi?id=974271
[ 2 ] Bug #965852 - CVE-2013-2104 OpenStack Keystone: Missing expiration check in Keystone PKI token validation
https://bugzilla.redhat.com/show_bug.cgi?id=965852
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update python-keystoneclient' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
More information about the package-announce
mailing list