| *** mhen_ is now known as mhen | 02:52 | |
| *** croeland1 is now known as croelandt | 14:50 | |
| opendevreview | Jeremy Stanley proposed openstack/keystonemiddleware master: Fix privilege escalation via spoofed identity headers https://review.opendev.org/c/openstack/keystonemiddleware/+/973494 | 15:03 |
|---|---|---|
| opendevreview | Jeremy Stanley proposed openstack/keystonemiddleware stable/2025.2: Fix privilege escalation via spoofed identity headers https://review.opendev.org/c/openstack/keystonemiddleware/+/973495 | 15:04 |
| opendevreview | Jeremy Stanley proposed openstack/keystonemiddleware stable/2025.1: Fix privilege escalation via spoofed identity headers https://review.opendev.org/c/openstack/keystonemiddleware/+/973496 | 15:05 |
| opendevreview | Jeremy Stanley proposed openstack/keystonemiddleware stable/2024.2: Fix privilege escalation via spoofed identity headers https://review.opendev.org/c/openstack/keystonemiddleware/+/973497 | 15:06 |
| zigo | xek: Hi there1 Do you know where in keystonemiddleware should this be patched, in version prior Caracal, as keystonemiddleware/external_oauth2_token.py doesn't exist there? | 15:34 |
| gtema | most likely this didn't exist before | 15:35 |
| gtema | but lemme check | 15:35 |
| gtema | neah, it was just added 3 years ago | 15:36 |
| zigo | So only Caracal and up are affected? | 15:36 |
| zigo | fungi: You may want to write this in your advisory, rather than saying >= 10.0, that would be >= 10.5 or 10.6 (bobcat is 10.4). | 15:37 |
| * zigo got to go | 15:39 | |
| fungi | thanks! i wouldn't normally have included a lower-bound, but xek explicitly stated "The external_oauth2_token middleware was introduced in keystonemiddleware 10.0.0." in https://bugs.launchpad.net/keystonemiddleware/+bug/2129018 (comment #11) and no other keystone folks disagreed | 15:42 |
| gtema | the api has been added in 2023.1 https://docs.openstack.org/releasenotes/keystone/2023.1.html#relnotes-23-0-0-unmaintained-2023-1-new-features, the middleware RN hints it has been added in 10.1.0 | 15:42 |
| gtema | so it is still something like 10.0 | 15:43 |
| gtema | and it falls into the 2023.1 | 15:43 |
| fungi | keystonemiddleware 10.0.0 and 10.1.0 were both tagged in the zed cycle according to https://releases.openstack.org/teams/keystone.html#zed | 15:45 |
| fungi | 10.2.0 was the earliest keystonemiddleware tag in 2023.1 | 15:47 |
| gtema | ok, then the RN for keystonemiddleware is a bit broken - it lists this under zed AND 2023.1 | 15:47 |
| gtema | I stopped on the first match | 15:47 |
| gtema | I see now the API (that exposes this functionality) has been added in keystone 22.0 (zed) - https://docs.openstack.org/releasenotes/keystone/zed.html#relnotes-22-0-0-unmaintained-zed | 15:49 |
| gtema | but now that it was asked: I see the initial implementation was included according to gerrit starting with 10.5.0 and is earliest in unmaintained/2024.1 branch | 15:54 |
| gtema | (https://review.opendev.org/c/openstack/keystonemiddleware/+/868734) | 15:55 |
| fungi | so if we adjust the advisory, 10.5.0 is the actual earliest affected version of ksm? | 16:11 |
| gtema | seems to be, yes | 16:12 |
| fungi | thanks for digging into that! | 16:14 |
| gtema | wlcm | 16:14 |
| fungi | i'll work up an errata correction to that later today, and batch it up with any other corrections anyone identifies | 16:17 |
| gtema | I have identified how to "disable" the functionality if someone wants a quick workaround. You need to forcibly empty value in the keystone config (`[oauth2].oauth2_authn_methods = ''`) | 16:19 |
| gtema | I have not tested it though - it is just a code based analysis. And we are talking about the keystone config | 16:20 |
| *** gmaan is now known as gmaan_afk | 16:33 | |
| opendevreview | Artem Goncharov proposed openstack/keystonemiddleware master: Fix privilege escalation via spoofed identity headers https://review.opendev.org/c/openstack/keystonemiddleware/+/973494 | 17:31 |
| opendevreview | Artem Goncharov proposed openstack/keystonemiddleware stable/2024.2: Fix privilege escalation via spoofed identity headers https://review.opendev.org/c/openstack/keystonemiddleware/+/973497 | 17:32 |
| opendevreview | Artem Goncharov proposed openstack/keystonemiddleware stable/2025.1: Fix privilege escalation via spoofed identity headers https://review.opendev.org/c/openstack/keystonemiddleware/+/973496 | 17:33 |
| opendevreview | Artem Goncharov proposed openstack/keystonemiddleware stable/2025.2: Fix privilege escalation via spoofed identity headers https://review.opendev.org/c/openstack/keystonemiddleware/+/973495 | 17:34 |
| fungi | thanks for taking care of that, i saw it was failing on a line long enough to anger flake8 | 17:37 |
| gtema | yeah, I am glad there are no functional test failures - this is something we can never be sure in advance | 17:38 |
| *** gmaan_afk is now known as gmaan | 17:46 | |
| opendevreview | Douglas Mendizábal proposed openstack/keystone master: Update hard-coded policy for GET /v3/limits https://review.opendev.org/c/openstack/keystone/+/973163 | 19:01 |
| fungi | zuul came back +1 on all the ossa-2026-001 changes after gtema revised them. would be good to expedite keystone-core approval since they were already pre-reviewed as bug attachments while under embargo | 19:41 |
| zigo | fungi: FYI, that's my understanding digging for the issue too. This commit introduces the patched file: https://review.opendev.org/c/openstack/keystonemiddleware/+/868734 which got part of 10.5.0, however, 10.5.0 was "master" during the Caracal cycle, ie when Caracal was released, keystonemiddleware was already released as 10.6.0. | 21:19 |
| zigo | That's unless the security issue is also in some other files than keystonemiddleware/external_oauth2_token.py ... | 21:19 |
| fungi | zigo: it's entirely possible that xek was mistaken or mistyped the version in the bug report, i guess it would be good to give him a chance to confirm | 21:22 |
| zigo | I'd love to have it confirmed too. | 21:22 |
| zigo | As I wrote earlier: I don't understand how that works. | 21:22 |
Generated by irclog2html.py 4.0.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!