This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============0206966640880015216==
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature";
 boundary="7G5hi5RnA9Q886dd8nuU4EndAbscWuhk7"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--7G5hi5RnA9Q886dd8nuU4EndAbscWuhk7
Content-Type: text/plain; charset=UTF-
Content-Transfer-Encoding: quoted-printable


==========================================================================
Ubuntu Security Notice USN-2061-1
December 19, 2013

keystone vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.10

Summary:

Keystone access controls could be circumvented via EC2-style tokens.

Software Description:
- keystone: OpenStack identity service

Details:

Steven Hardy discovered that Keystone did not properly enforce trusts when
using the ec2tokens API. An authenticated attacker could exploit this to
retrieve a token not scoped to the trust and elevate privileges to the
trustor's roles.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  python-keystone                 1:2013.2-0ubuntu1.2

In general, a standard system update will make all the necessary changes.

References:
  http://www.ubuntu.com/usn/usn-2061-1
  CVE-2013-6391

Package Information:
  https://launchpad.net/ubuntu/+source/keystone/1:2013.2-0ubuntu1.2





--7G5hi5RnA9Q886dd8nuU4EndAbscWuhk7
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBCgAGBQJSs33xAAoJEFHb3FjMVZVzC+AQAI7ux3tSOBc45gRdKu+MT6Bb
JgzjArN+wDGHvrdYC8WwTCPdoDGs/dPhnsd9TXInRBMnYwePa52P/Wa0TjRvKFks
GyUR7nOjM8/fCfmb/fhpTzaPfWSY2stVSAQ6OBc+aAh7zrj6PuZpTX2fnloNBjli
Bi1aWqpuEomzf65DGoNr+vckl+9s7B63bRnN457QEfH6srVT/l4DGY8A9yeOvZdH
vpcCGyxfqHirolIssoyR0R2OYpBtrcJ15734bmqWy3jGHSZcIddFk3nV3caq+9MF
/emtn9a/88FJ5lpg7bGETbSe8JiafkdX8eJJ28QnyTKRyKjHSasaUTAh5HgdwF3p
+7MiI089mOcaMn6kFLthLDK3vViJJ56y0QBJOf3155AfnRJYFyPr7ZdRyNhB3L8r
5B8QThy2mQXaEr7XXcjoMwoQxFuODVeCyehIRf32dxyPUQD02pju6eaKVUTnPCS9
a8M8jr2LVRce3NBPSonqznnpyHRYPX4Mf4JHgz6DQqPT+w9UtCY+hNbrklDxnlLj
crGym+SqRpFdpU5gk8ukEMXmtrCqLLNarLsXkVYUFIY512HmtXtsOFAd6GXG1p0C
j1BudGAOV82ymCOkv31qJXTM9su4jxQPZHaQizflHNrQz3Ec75ValHlAu17VESSD
WCmCPB4qtDQOSilmBaL6
=d8en
-----END PGP SIGNATURE-----

--7G5hi5RnA9Q886dd8nuU4EndAbscWuhk7--


--===============0206966640880015216==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============0206966640880015216==--