fix for CVE-2013-1977 bug 466500

(Portage version: 2.1.11.62/cvs/Linux x86_64, signed Manifest commit with key 0x2471eb3e40ac5ac3)

4 files changed, 72 insertions, 2 deletions

diff --git a/sys-auth/keystone/ChangeLog b/sys-auth/keystone/ChangeLog
index 529317ee263b..d427f47e952b 100644
--- a/sys-auth/keystone/ChangeLog
+++ b/sys-auth/keystone/ChangeLog
@@ -1,6 +1,14 @@
 # ChangeLog for sys-auth/keystone
 # Copyright 1999-2013 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-auth/keystone/ChangeLog,v 1.17 2013/05/10 16:14:06 prometheanfire Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-auth/keystone/ChangeLog,v 1.18 2013/05/17 15:35:49 prometheanfire Exp $
+
+*keystone-2012.2.4-r3 (17 May 2013)
+
+  17 May 2013; Matthew Thode <prometheanfire@gentoo.org>
+  +files/keystone-folsom-4-CVE-2013-1977.patch,
+  +files/keystone-grizzly-1-CVE-2013-1977.patch, +keystone-2012.2.4-r3.ebuild,
+  -keystone-2012.2.4-r2.ebuild:
+  fix for CVE-2013-1977 bug 466500
 
 *keystone-2012.2.4-r2 (10 May 2013)
 
diff --git a/sys-auth/keystone/files/keystone-folsom-4-CVE-2013-1977.patch b/sys-auth/keystone/files/keystone-folsom-4-CVE-2013-1977.patch
new file mode 100644
index 000000000000..91084fc23fb3
--- /dev/null
+++ b/sys-auth/keystone/files/keystone-folsom-4-CVE-2013-1977.patch
@@ -0,0 +1,21 @@
+diff -Naur keystone-2012.2.4/keystone/config.py keystone-2012.2.4.new/keystone/config.py
+--- keystone-2012.2.4/keystone/config.py	2013-04-11 15:02:19.000000000 -0400
++++ keystone-2012.2.4.new/keystone/config.py	2013-05-17 11:26:57.557918817 -0400
+@@ -110,7 +110,7 @@
+     group = kw.pop('group', None)
+     return conf.register_cli_opt(cfg.IntOpt(*args, **kw), group=group)
+ 
+-register_str('admin_token', default='ADMIN')
++register_str('admin_token', secret=True, default='ADMIN')
+ register_str('bind_host', default='0.0.0.0')
+ register_str('compute_port', default=8774)
+ register_str('admin_port', default=35357)
+@@ -162,7 +162,7 @@
+ #ldap
+ register_str('url', group='ldap', default='ldap://localhost')
+ register_str('user', group='ldap', default='dc=Manager,dc=example,dc=com')
+-register_str('password', group='ldap', default='freeipa4all')
++register_str('password', group='ldap', secret=True, default='freeipa4all')
+ register_str('suffix', group='ldap', default='cn=example,cn=com')
+ register_bool('use_dumb_member', group='ldap', default=False)
+ register_str('user_name_attribute', group='ldap', default='sn')
diff --git a/sys-auth/keystone/files/keystone-grizzly-1-CVE-2013-1977.patch b/sys-auth/keystone/files/keystone-grizzly-1-CVE-2013-1977.patch
new file mode 100644
index 000000000000..355d4a33edd2
--- /dev/null
+++ b/sys-auth/keystone/files/keystone-grizzly-1-CVE-2013-1977.patch
@@ -0,0 +1,40 @@
+From d43e2a51a1ed7adbed3c5ddf001d46bc4a824ae8 Mon Sep 17 00:00:00 2001
+From: Xuhan Peng <xuhanp@cn.ibm.com>
+Date: Fri, 12 Apr 2013 16:19:37 +0800
+Subject: [PATCH] Mark LDAP password and admin_token secret
+
+Add secret=True to LDAP password and admin_token
+of keystone configuration.
+
+Fix bug #1172195
+
+Change-Id: I8ef7f705e3f6b374ff427c20eb761892d5146a75
+---
+ keystone/common/config.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/keystone/common/config.py b/keystone/common/config.py
+index d7b6ff7..84ea83f 100644
+--- a/keystone/common/config.py
++++ b/keystone/common/config.py
+@@ -188,7 +188,7 @@ def configure():
+     register_cli_str('pydev-debug-host', default=None)
+     register_cli_int('pydev-debug-port', default=None)
+ 
+-    register_str('admin_token', default='ADMIN')
++    register_str('admin_token', secret=True, default='ADMIN')
+     register_str('bind_host', default='0.0.0.0')
+     register_int('compute_port', default=8774)
+     register_int('admin_port', default=35357)
+@@ -286,7 +286,7 @@ def configure():
+     # ldap
+     register_str('url', group='ldap', default='ldap://localhost')
+     register_str('user', group='ldap', default=None)
+-    register_str('password', group='ldap', default=None)
++    register_str('password', group='ldap', secret=True, default=None)
+     register_str('suffix', group='ldap', default='cn=example,cn=com')
+     register_bool('use_dumb_member', group='ldap', default=False)
+     register_str('dumb_member', group='ldap', default='cn=dumb,dc=nonexistent')
+-- 
+1.8.1.5
+
diff --git a/sys-auth/keystone/keystone-2012.2.4-r2.ebuild b/sys-auth/keystone/keystone-2012.2.4-r3.ebuild
index c17b197b8cbc..b4e12026585f 100644
--- a/sys-auth/keystone/keystone-2012.2.4-r2.ebuild
+++ b/sys-auth/keystone/keystone-2012.2.4-r3.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2013 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-auth/keystone/keystone-2012.2.4-r2.ebuild,v 1.1 2013/05/10 16:14:06 prometheanfire Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-auth/keystone/keystone-2012.2.4-r3.ebuild,v 1.1 2013/05/17 15:35:49 prometheanfire Exp $
 
 EAPI=5
 #test restricted becaues of bad requirements given (old webob for instance)
@@ -72,6 +72,7 @@ RDEPEND="${DEPEND}
 PATCHES=(
 	"${FILESDIR}/keystone-folsom-4-CVE-2013-2030.patch"
 	"${FILESDIR}/keystone-folsom-4-CVE-2013-2059.patch"
+	"${FILESDIR}/keystone-folsom-4-CVE-2013-1977.patch"
 )
 
 python_install() {