CVE-2013-2030 OpenStack Nova uses insecure keystone middleware tmpdir by default

What is CVE-2013-2030?

CVE-2013-2030 is a low-severity path traversal vulnerability in n/a, published on 27 Dec 2013. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora.

Weakness: CWE-264

Which versions are affected by CVE-2013-2030?

3 open source packages ship an affected version, including python-keystoneclient. It affects 4 products.

Products include Openstack Compute, Openstack Folsom, Openstack Grizzly, Openstack Havana.

How do I fix CVE-2013-2030?

Upgrade python-keystoneclient to 0.2.4 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2013-2030 being exploited?

There is no known exploitation of CVE-2013-2030 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2013-7130 OpenStack Nova Live migration can leak root disk into ephemeral storage High 7.1
• CVE-2014-0167 OpenStack Compute (Nova) allows remote authenticated users to gain privileges via API requests Medium 6.0
• CVE-2015-2687 OpenStack Compute (Nova) Improper Access Control Medium 4.7
• CVE-2013-4179 OpenStack Compute (Nova) vulnerable to denial of service via XML Entity Expansion attack Medium 4.3
• CVE-2012-2654 OpenStack Compute (Nova) Improper Input Validation Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pxxv-rv32-2qgv, PYSEC-2026-911.