CVE-2014-0105: Privilege escalation in auth_token middleware under sufficient load
(updated )
By doing repeated requests, with sufficient load on the target system, an authenticated user may in certain situations assume another authenticated user’s complete identity and multi-tenant authorizations, potentially resulting in a privilege escalation. Note that it is related to a bad interaction between eventlet and python-memcached that should be avoided if the calling process already monkey-patches “thread” to use eventlet. Only keystone middleware setups using auth_token with memcache are vulnerable.
References
Detect and mitigate CVE-2014-0105 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →