CVE-2013-2166

Python-keystoneclient 0.2.3 to 0.2.5 allows memcache encryption bypass

• CVSS 9.8
• CWE-326 Inadequate Encryption Strength
• Input Validation and Sanitization
• Remote

python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass

CVE

CVE-2013-2166

CWE

CWE-326 Inadequate Encryption Strength

CVSS base score

9.8

Published

2019-12-10

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update python-keystoneclient to version 0.2.6 or higher.

from keystoneclient.middleware import memcache

class MemcacheMiddleware(memcache.MemcacheMiddleware):
    def __init__(self, app, **kwargs):
        super(MemcacheMiddleware, self).__init__(app, **kwargs)

    def _get_cache_key(self, key):
        return key

from keystoneclient.middleware import memcache

class MemcacheMiddleware(memcache.MemcacheMiddleware):
    def __init__(self, app, **kwargs):
        super(MemcacheMiddleware, self).__init__(app, **kwargs)
        self.encryption_key = kwargs.get('encryption_key')

    def _get_cache_key(self, key):
        return self._encrypt_key(key)

    def _encrypt_key(self, key):
        from cryptography.fernet import Fernet
        fernet = Fernet(self.encryption_key)
        return fernet.encrypt(key.encode()).decode()

@misc{vaitp:cve20132166,
  title        = {{Python-keystoneclient 0.2.3 to 0.2.5 allows memcache encryption bypass}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2013-2166},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2013-2166/}}
}