)]}'
{"security-notes/OSSN-0056":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"73c70a98433773cf4f2feb238e209a8e9fb9f6a9","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Keystone Token Caching is used to reduce the load on keystone services,"},{"line_number":6,"context_line":"by default tokens are valid for 300 seconds, to enable revocation of"},{"line_number":7,"context_line":"cached tokens, Token Revocation Lists (TRLs) are used, with a default"},{"line_number":8,"context_line":"lifetime of 10 seconds. This creates a misleading expectation that"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"da20952f_f8595a36","line":5,"updated":"2015-09-03 00:42:45.000000000","message":"lowercase \"token\" and \"caching\"\n\nchange ,s to ()","commit_id":"eb1ac5d6f2a4b3fa2ced87177ae080f60d0c80eb"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"73c70a98433773cf4f2feb238e209a8e9fb9f6a9","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Keystone Token Caching is used to reduce the load on keystone services,"},{"line_number":6,"context_line":"by default tokens are valid for 300 seconds, to enable revocation of"},{"line_number":7,"context_line":"cached tokens, Token Revocation Lists (TRLs) are used, with a default"},{"line_number":8,"context_line":"lifetime of 10 seconds. This creates a misleading expectation that"},{"line_number":9,"context_line":"revoked tokens will not be accepted more than 10 seconds after"},{"line_number":10,"context_line":"revocation, however the maximum lifespan of a cached token must be"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"da20952f_18820e53","line":7,"updated":"2015-09-03 00:42:45.000000000","message":"TRLs are actually for revocation of PKI tokens, not for cached tokens.","commit_id":"eb1ac5d6f2a4b3fa2ced87177ae080f60d0c80eb"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"73c70a98433773cf4f2feb238e209a8e9fb9f6a9","unresolved":false,"context_lines":[{"line_number":20,"context_line":"In previous versions of OpenStack, the Keystone middleware Token"},{"line_number":21,"context_line":"Revocation List (TRLs) lifespan was set to 5 minutes (300 seconds), this"},{"line_number":22,"context_line":"could allow an attacker to utilize a compromised token for up to 5"},{"line_number":23,"context_line":"minutes before the TRL expired. This was corrected in Juno, where the"},{"line_number":24,"context_line":"default TRL lifetime was reduced to 10 seconds. However, the addition of"},{"line_number":25,"context_line":"a token to a TRL does not guarantee that cached tokens will be rejected,"},{"line_number":26,"context_line":"so the attack window for a revoked token must be assumed to be the"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"da20952f_f8f5daec","line":23,"updated":"2015-09-03 00:42:45.000000000","message":"suggest change \"before the TRL expired\" to \"before the TRL was refreshed\".\n\nSuggest change \"corrected\" to \"changed\".","commit_id":"eb1ac5d6f2a4b3fa2ced87177ae080f60d0c80eb"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"73c70a98433773cf4f2feb238e209a8e9fb9f6a9","unresolved":false,"context_lines":[{"line_number":35,"context_line":"revocation_cache_time is set to 10 seconds not 300 seconds (as patched"},{"line_number":36,"context_line":"in Juno)."},{"line_number":37,"context_line":"- Review the implications of the default 300 second token lifetime and"},{"line_number":38,"context_line":"any risks associated with the use of revoked certificates for up to that"},{"line_number":39,"context_line":"lifetime. If this is unacceptable, reduce the lifetime to reduce the"},{"line_number":40,"context_line":"attack window, or disable token caching entirely."},{"line_number":41,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"da20952f_98c4de92","line":38,"updated":"2015-09-03 00:42:45.000000000","message":"change \"certificates\" to \"tokens\"","commit_id":"eb1ac5d6f2a4b3fa2ced87177ae080f60d0c80eb"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"73c70a98433773cf4f2feb238e209a8e9fb9f6a9","unresolved":false,"context_lines":[{"line_number":37,"context_line":"- Review the implications of the default 300 second token lifetime and"},{"line_number":38,"context_line":"any risks associated with the use of revoked certificates for up to that"},{"line_number":39,"context_line":"lifetime. If this is unacceptable, reduce the lifetime to reduce the"},{"line_number":40,"context_line":"attack window, or disable token caching entirely."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"### Contacts / References ###"},{"line_number":43,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0056"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"da20952f_58be4600","line":40,"updated":"2015-09-03 00:42:45.000000000","message":"remove the ,","commit_id":"eb1ac5d6f2a4b3fa2ced87177ae080f60d0c80eb"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"27aaf075a87fd7ae3ccfdc7d0f194168c776ef06","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Keystone token caching is used to reduce the load on keystone service()"},{"line_number":6,"context_line":"by default tokens are valid for 300 seconds, to enable revocation of cached"},{"line_number":7,"context_line":"tokens, with a default lifetime of 10 seconds. This creates a misleading"},{"line_number":8,"context_line":"expectation that revoked tokens will not be accepted more than 10 seconds"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"da20952f_7961a8a7","line":5,"updated":"2015-09-03 18:08:25.000000000","message":"Change \"Keystone\" to \"Keystone auth token middleware\"\n\nchange \"on keystone service\" to \"on the keystone service\"\n\nremove ()","commit_id":"015b676aaf25ef0a3a232cfb6b451ab11178f318"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"27aaf075a87fd7ae3ccfdc7d0f194168c776ef06","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Keystone token caching is used to reduce the load on keystone service()"},{"line_number":6,"context_line":"by default tokens are valid for 300 seconds, to enable revocation of cached"},{"line_number":7,"context_line":"tokens, with a default lifetime of 10 seconds. This creates a misleading"},{"line_number":8,"context_line":"expectation that revoked tokens will not be accepted more than 10 seconds"},{"line_number":9,"context_line":"after revocation, however the maximum lifespan of a cached token must be"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"da20952f_99559cc7","line":6,"updated":"2015-09-03 18:08:25.000000000","message":"put () around the aside (by default tokens are valid for 300 seconds)","commit_id":"015b676aaf25ef0a3a232cfb6b451ab11178f318"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"27aaf075a87fd7ae3ccfdc7d0f194168c776ef06","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Keystone token caching is used to reduce the load on keystone service()"},{"line_number":6,"context_line":"by default tokens are valid for 300 seconds, to enable revocation of cached"},{"line_number":7,"context_line":"tokens, with a default lifetime of 10 seconds. This creates a misleading"},{"line_number":8,"context_line":"expectation that revoked tokens will not be accepted more than 10 seconds"},{"line_number":9,"context_line":"after revocation, however the maximum lifespan of a cached token must be"},{"line_number":10,"context_line":"assumed to be the cache duration. System owners should make a risk based"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"da20952f_798be81e","line":7,"updated":"2015-09-03 18:08:25.000000000","message":"suggest change \"lifetime\" to \"timeout\"","commit_id":"015b676aaf25ef0a3a232cfb6b451ab11178f318"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"02a90061d42b82b33fe8ee213e163e2c7d037d02","unresolved":false,"context_lines":[{"line_number":13,"context_line":"be disabled."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Affected Services / Software ###"},{"line_number":16,"context_line":"Nova, Kilo, Juno"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"### Discussion ###"},{"line_number":19,"context_line":"In previous versions of OpenStack, the Keystone middleware Token Revocation"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"da20952f_d4a52347","line":16,"updated":"2015-09-03 15:57:17.000000000","message":"All services that use keystonemiddleware. All releases (up to liberty3 as well)","commit_id":"015b676aaf25ef0a3a232cfb6b451ab11178f318"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"27aaf075a87fd7ae3ccfdc7d0f194168c776ef06","unresolved":false,"context_lines":[{"line_number":16,"context_line":"Nova, Kilo, Juno"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"### Discussion ###"},{"line_number":19,"context_line":"In previous versions of OpenStack, the Keystone middleware Token Revocation"},{"line_number":20,"context_line":"List (TRLs) lifespan was set to 5 minutes (300 seconds), this could allow an"},{"line_number":21,"context_line":"attacker to utilize a compromised token for up to 5 minutes before the TRL"},{"line_number":22,"context_line":"refreshes. This was changed in Juno, where the default TRL lifetime was reduced"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"da20952f_7992084d","line":19,"updated":"2015-09-03 18:08:25.000000000","message":"change \"Keysotne middleware\" to \"keystone auth token middleware\"","commit_id":"015b676aaf25ef0a3a232cfb6b451ab11178f318"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"27aaf075a87fd7ae3ccfdc7d0f194168c776ef06","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"### Discussion ###"},{"line_number":19,"context_line":"In previous versions of OpenStack, the Keystone middleware Token Revocation"},{"line_number":20,"context_line":"List (TRLs) lifespan was set to 5 minutes (300 seconds), this could allow an"},{"line_number":21,"context_line":"attacker to utilize a compromised token for up to 5 minutes before the TRL"},{"line_number":22,"context_line":"refreshes. This was changed in Juno, where the default TRL lifetime was reduced"},{"line_number":23,"context_line":"to 10 seconds. However, the addition of a token to a TRL does not guarantee"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"da20952f_f99e1853","line":20,"updated":"2015-09-03 18:08:25.000000000","message":"change \"TRLs\" to \"TRL\"\n\nsuggest change \"lifespan\" to \"timeout\"\n\nsuggest remove \"(300 seconds)\" since this is obvious.","commit_id":"015b676aaf25ef0a3a232cfb6b451ab11178f318"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"62bbc46a02ef04e8f9c8a072d9d27ff96dfcc422","unresolved":false,"context_lines":[{"line_number":18,"context_line":"### Discussion ###"},{"line_number":19,"context_line":"In previous versions of OpenStack, the keystone auth token middleware Token"},{"line_number":20,"context_line":"Revocation List (TRL) timeout was set to 5 minutes, this could allow an attacker"},{"line_number":21,"context_line":"to utilize a compromised token for up to 5 minutes before the TRL refreshes. This "},{"line_number":22,"context_line":"was changed in Juno, where the default TRL lifetime was reduced to 10 seconds. "},{"line_number":23,"context_line":"However, the addition of a token to a TRL does not guarantee that cached tokens"},{"line_number":24,"context_line":"will be rejected, so the attack window for a revoked token must be assumed to be"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"da20952f_690a358c","line":21,"updated":"2015-09-03 18:29:37.000000000","message":"hanging whitespace","commit_id":"f0c0ec766ff7d4462964dc61925fefd05b598b76"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"62bbc46a02ef04e8f9c8a072d9d27ff96dfcc422","unresolved":false,"context_lines":[{"line_number":19,"context_line":"In previous versions of OpenStack, the keystone auth token middleware Token"},{"line_number":20,"context_line":"Revocation List (TRL) timeout was set to 5 minutes, this could allow an attacker"},{"line_number":21,"context_line":"to utilize a compromised token for up to 5 minutes before the TRL refreshes. This "},{"line_number":22,"context_line":"was changed in Juno, where the default TRL lifetime was reduced to 10 seconds. "},{"line_number":23,"context_line":"However, the addition of a token to a TRL does not guarantee that cached tokens"},{"line_number":24,"context_line":"will be rejected, so the attack window for a revoked token must be assumed to be"},{"line_number":25,"context_line":"the lifespan of the cached token."}],"source_content_type":"application/octet-stream","patch_set":6,"id":"da20952f_89ef89b0","line":22,"updated":"2015-09-03 18:29:37.000000000","message":"hanging whitespace","commit_id":"f0c0ec766ff7d4462964dc61925fefd05b598b76"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"c4082b7af430bf96b69bbd06504a669ecb721123","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"### Discussion ###"},{"line_number":19,"context_line":"In previous versions of OpenStack, the keystone auth token middleware Token"},{"line_number":20,"context_line":"Revocation List (TRL) timeout was set to 5 minutes, this could allow an attacker"},{"line_number":21,"context_line":"to utilize a compromised token for up to 5 minutes before the TRL refreshes. This"},{"line_number":22,"context_line":"was changed in Juno, where the default TRL lifetime was reduced to 10 seconds."},{"line_number":23,"context_line":"However, the addition of a token to a TRL does not guarantee that cached tokens"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"da20952f_4fead110","line":20,"updated":"2015-09-03 18:58:40.000000000","message":"looks like this line, 21, and 24 are too long","commit_id":"374c38021ef4042b73771aa0d5b99706aaa28baa"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"368019bbf84e836fe7c38289f6c7e66cd6d124b9","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Cached Keystone tokens may be accepted after revocation"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":9,"id":"da20952f_72669e52","line":1,"updated":"2015-09-03 19:46:31.000000000","message":"suggest lowercase \"keystone\" for consistency.","commit_id":"686a3184955037a2b1958d6c77eae6b3726590f1"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"368019bbf84e836fe7c38289f6c7e66cd6d124b9","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Keystone auth_token middleware token caching is used to reduce the load"},{"line_number":6,"context_line":"on the keystone service to enable revocation of cached tokens, with a"},{"line_number":7,"context_line":"default token validity of 300 seconds and default timeout of 10 seconds."},{"line_number":8,"context_line":"This creates a misleading expectation that revoked tokens will not be"},{"line_number":9,"context_line":"accepted more than 10 seconds after revocation, however the maximum"}],"source_content_type":"application/octet-stream","patch_set":9,"id":"da20952f_f2006e36","line":6,"updated":"2015-09-03 19:46:31.000000000","message":"add a . after \"service\"... or maybe this is just needs to be reworded since token caching isn\u0027t used to enable revocation of cached tokens.","commit_id":"686a3184955037a2b1958d6c77eae6b3726590f1"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"368019bbf84e836fe7c38289f6c7e66cd6d124b9","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Keystone auth_token middleware token caching is used to reduce the load"},{"line_number":6,"context_line":"on the keystone service to enable revocation of cached tokens, with a"},{"line_number":7,"context_line":"default token validity of 300 seconds and default timeout of 10 seconds."},{"line_number":8,"context_line":"This creates a misleading expectation that revoked tokens will not be"},{"line_number":9,"context_line":"accepted more than 10 seconds after revocation, however the maximum"},{"line_number":10,"context_line":"validity of a cached token must be assumed to be the cache duration."}],"source_content_type":"application/octet-stream","patch_set":9,"id":"da20952f_721e9e71","line":7,"updated":"2015-09-03 19:46:31.000000000","message":"suggest change \"validity\" to \"cache time\"","commit_id":"686a3184955037a2b1958d6c77eae6b3726590f1"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"368019bbf84e836fe7c38289f6c7e66cd6d124b9","unresolved":false,"context_lines":[{"line_number":16,"context_line":"OpenStack Services that use Keystone middleware: Kilo, Juno, Liberty"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"### Discussion ###"},{"line_number":19,"context_line":"In previous versions of OpenStack, the keystone auth_token middleware"},{"line_number":20,"context_line":"Token Revocation List (TRL) timeout was set to 300 seconds which could"},{"line_number":21,"context_line":"allow an attacker to utilize a compromised token for up to 300 seconds"},{"line_number":22,"context_line":"before the TRL refreshes. This was changed in Juno, where the default"}],"source_content_type":"application/octet-stream","patch_set":9,"id":"da20952f_527a7af2","line":19,"updated":"2015-09-03 19:46:31.000000000","message":"auth_token middleware has a few options to configure token caching:\n\n - token_cache_time (defaults to 300 seconds), which is how long auth_token caches tokens.\n\n - revocation_cache_time (defaults to 10 seconds), which is how long auth_token caches the token revocation list.\n\n - check_revocations_for_cached (defaults to false), which determines if the revocation list will be checked for cached tokens.\n\nIf check_revocations_for_cached is disabled then tokens are valid after caching for token_cache_time (or if the token expires). If check_revocations_for_cached is enabled then tokens are also invalid after the revocation_cache_time.","commit_id":"686a3184955037a2b1958d6c77eae6b3726590f1"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"368019bbf84e836fe7c38289f6c7e66cd6d124b9","unresolved":false,"context_lines":[{"line_number":36,"context_line":"risks associated with the use of revoked tokens for up to that lifetime."},{"line_number":37,"context_line":"If this is unacceptable, reduce the lifetime to reduce the attack window or"},{"line_number":38,"context_line":"disable token caching entirely."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"### Contacts / References ###"},{"line_number":42,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0056"}],"source_content_type":"application/octet-stream","patch_set":9,"id":"da20952f_bd4f2733","line":39,"updated":"2015-09-03 19:46:31.000000000","message":"Recommendation should be to set check_revocations_for_cached to true if the deployer wants to use the revocation_cache_time as the time for cached tokens to become unusable. Note that this requires PKI be enabled on the keystone server.\n\nThe action should include information on how to disable the cache -- set revocation_cache_time to -1.","commit_id":"686a3184955037a2b1958d6c77eae6b3726590f1"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f88c7ee7b698caae99e86c8fb29c925f29c11981","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Keystone auth_token middleware token caching is used to reduce the load"},{"line_number":6,"context_line":"on the keystone service while enabling the revocation of cached tokens."},{"line_number":7,"context_line":"The default token cache time is set to 300 seconds with a default timeout"},{"line_number":8,"context_line":"of 10 seconds. This creates a misleading expectation that revoked tokens"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"da20952f_556fbffb","line":5,"updated":"2015-09-03 22:17:30.000000000","message":"suggest change \"token caching\" to \"token and revocation list caching\"","commit_id":"48369e2c69edc58d3c7aef0e26f75aa2f5c11ba6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f88c7ee7b698caae99e86c8fb29c925f29c11981","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Keystone auth_token middleware token caching is used to reduce the load"},{"line_number":6,"context_line":"on the keystone service while enabling the revocation of cached tokens."},{"line_number":7,"context_line":"The default token cache time is set to 300 seconds with a default timeout"},{"line_number":8,"context_line":"of 10 seconds. This creates a misleading expectation that revoked tokens"},{"line_number":9,"context_line":"will not be accepted more than 10 seconds after revocation, however the"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"da20952f_359c8b0d","line":6,"updated":"2015-09-03 22:17:30.000000000","message":"token caching doesn\u0027t enable the revocation of cached tokens. The part \"while enabling ... \" can just be removed.","commit_id":"48369e2c69edc58d3c7aef0e26f75aa2f5c11ba6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f88c7ee7b698caae99e86c8fb29c925f29c11981","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Keystone auth_token middleware token caching is used to reduce the load"},{"line_number":6,"context_line":"on the keystone service while enabling the revocation of cached tokens."},{"line_number":7,"context_line":"The default token cache time is set to 300 seconds with a default timeout"},{"line_number":8,"context_line":"of 10 seconds. This creates a misleading expectation that revoked tokens"},{"line_number":9,"context_line":"will not be accepted more than 10 seconds after revocation, however the"},{"line_number":10,"context_line":"maximum validity of a cached token must be assumed to be the cache duration."}],"source_content_type":"application/octet-stream","patch_set":10,"id":"da20952f_d58d0fd4","line":7,"updated":"2015-09-03 22:17:30.000000000","message":"suggest remove \"set to\"","commit_id":"48369e2c69edc58d3c7aef0e26f75aa2f5c11ba6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f88c7ee7b698caae99e86c8fb29c925f29c11981","unresolved":false,"context_lines":[{"line_number":5,"context_line":"Keystone auth_token middleware token caching is used to reduce the load"},{"line_number":6,"context_line":"on the keystone service while enabling the revocation of cached tokens."},{"line_number":7,"context_line":"The default token cache time is set to 300 seconds with a default timeout"},{"line_number":8,"context_line":"of 10 seconds. This creates a misleading expectation that revoked tokens"},{"line_number":9,"context_line":"will not be accepted more than 10 seconds after revocation, however the"},{"line_number":10,"context_line":"maximum validity of a cached token must be assumed to be the cache duration."},{"line_number":11,"context_line":"System owners should make a risk based decision to balance token lifespan"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"da20952f_75644321","line":8,"updated":"2015-09-03 22:17:30.000000000","message":"suggest change this to ...\n\n The default token cache time is set to 300 seconds and the default token\n revocation list cache time is set to 10 seconds.","commit_id":"48369e2c69edc58d3c7aef0e26f75aa2f5c11ba6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f88c7ee7b698caae99e86c8fb29c925f29c11981","unresolved":false,"context_lines":[{"line_number":16,"context_line":"OpenStack Services that use Keystone middleware: Kilo, Juno, Liberty"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"### Discussion ###"},{"line_number":19,"context_line":"There are multiple options for configuration of keystone auth_token middleware."},{"line_number":20,"context_line":"These options include token_cache_time, revocation_cache_time and"},{"line_number":21,"context_line":"check_revocations_for_cached, with each component affecting the different"},{"line_number":22,"context_line":"stages of token provisioning and revocation. Depending on the configuration of"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"da20952f_6800e601","line":19,"updated":"2015-09-03 22:17:30.000000000","message":"suggest change \"configuration of\" to \"configuring token caching in the\"","commit_id":"48369e2c69edc58d3c7aef0e26f75aa2f5c11ba6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f88c7ee7b698caae99e86c8fb29c925f29c11981","unresolved":false,"context_lines":[{"line_number":18,"context_line":"### Discussion ###"},{"line_number":19,"context_line":"There are multiple options for configuration of keystone auth_token middleware."},{"line_number":20,"context_line":"These options include token_cache_time, revocation_cache_time and"},{"line_number":21,"context_line":"check_revocations_for_cached, with each component affecting the different"},{"line_number":22,"context_line":"stages of token provisioning and revocation. Depending on the configuration of"},{"line_number":23,"context_line":"the previously mentioned components an attacker could a compromised token for"},{"line_number":24,"context_line":"up to 300 seconds before the token becomes disabled. To rectify this issue a"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"da20952f_480ba224","line":21,"updated":"2015-09-03 22:17:30.000000000","message":"change \"component\" to \"option\"","commit_id":"48369e2c69edc58d3c7aef0e26f75aa2f5c11ba6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f88c7ee7b698caae99e86c8fb29c925f29c11981","unresolved":false,"context_lines":[{"line_number":19,"context_line":"There are multiple options for configuration of keystone auth_token middleware."},{"line_number":20,"context_line":"These options include token_cache_time, revocation_cache_time and"},{"line_number":21,"context_line":"check_revocations_for_cached, with each component affecting the different"},{"line_number":22,"context_line":"stages of token provisioning and revocation. Depending on the configuration of"},{"line_number":23,"context_line":"the previously mentioned components an attacker could a compromised token for"},{"line_number":24,"context_line":"up to 300 seconds before the token becomes disabled. To rectify this issue a"},{"line_number":25,"context_line":"change was issued in Juno, where the default Token Revocation List (TRL)"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"da20952f_882c5a9a","line":22,"updated":"2015-09-03 22:17:30.000000000","message":"change \"provisioning\" to \"caching\"","commit_id":"48369e2c69edc58d3c7aef0e26f75aa2f5c11ba6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f88c7ee7b698caae99e86c8fb29c925f29c11981","unresolved":false,"context_lines":[{"line_number":20,"context_line":"These options include token_cache_time, revocation_cache_time and"},{"line_number":21,"context_line":"check_revocations_for_cached, with each component affecting the different"},{"line_number":22,"context_line":"stages of token provisioning and revocation. Depending on the configuration of"},{"line_number":23,"context_line":"the previously mentioned components an attacker could a compromised token for"},{"line_number":24,"context_line":"up to 300 seconds before the token becomes disabled. To rectify this issue a"},{"line_number":25,"context_line":"change was issued in Juno, where the default Token Revocation List (TRL)"},{"line_number":26,"context_line":"lifetime was reduced to 10 seconds. Although, the addition of a token to a"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"da20952f_08392ad7","line":23,"updated":"2015-09-03 22:17:30.000000000","message":"change \"components\" to \"options\"\n\nchange \"could a\" to \"could use a\"","commit_id":"48369e2c69edc58d3c7aef0e26f75aa2f5c11ba6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f88c7ee7b698caae99e86c8fb29c925f29c11981","unresolved":false,"context_lines":[{"line_number":21,"context_line":"check_revocations_for_cached, with each component affecting the different"},{"line_number":22,"context_line":"stages of token provisioning and revocation. Depending on the configuration of"},{"line_number":23,"context_line":"the previously mentioned components an attacker could a compromised token for"},{"line_number":24,"context_line":"up to 300 seconds before the token becomes disabled. To rectify this issue a"},{"line_number":25,"context_line":"change was issued in Juno, where the default Token Revocation List (TRL)"},{"line_number":26,"context_line":"lifetime was reduced to 10 seconds. Although, the addition of a token to a"},{"line_number":27,"context_line":"TRL does not guarantee that cached tokens will be rejected considering the"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"da20952f_28542efc","line":24,"updated":"2015-09-03 22:17:30.000000000","message":"suggest change \"300 seconds\" to \"token_cache_time seconds\"\n\nsuggest change \"rectify\" to \"mitigate\"","commit_id":"48369e2c69edc58d3c7aef0e26f75aa2f5c11ba6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f88c7ee7b698caae99e86c8fb29c925f29c11981","unresolved":false,"context_lines":[{"line_number":23,"context_line":"the previously mentioned components an attacker could a compromised token for"},{"line_number":24,"context_line":"up to 300 seconds before the token becomes disabled. To rectify this issue a"},{"line_number":25,"context_line":"change was issued in Juno, where the default Token Revocation List (TRL)"},{"line_number":26,"context_line":"lifetime was reduced to 10 seconds. Although, the addition of a token to a"},{"line_number":27,"context_line":"TRL does not guarantee that cached tokens will be rejected considering the"},{"line_number":28,"context_line":"operational nature of token  caching. For instance, if the"},{"line_number":29,"context_line":"check_revocations_for_cached is disabled then tokens are valid after"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"da20952f_286bceba","line":26,"updated":"2015-09-03 22:17:30.000000000","message":"add \"and the check_revocations_for_cached option was added\" to the first sentence.\n\nRemove , after \"Although\"","commit_id":"48369e2c69edc58d3c7aef0e26f75aa2f5c11ba6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f88c7ee7b698caae99e86c8fb29c925f29c11981","unresolved":false,"context_lines":[{"line_number":28,"context_line":"operational nature of token  caching. For instance, if the"},{"line_number":29,"context_line":"check_revocations_for_cached is disabled then tokens are valid after"},{"line_number":30,"context_line":"caching token_cache_time or the designated expiration given to the token."},{"line_number":31,"context_line":"Otherwise (if the check_revocations_for_cached is enabled) then tokens"},{"line_number":32,"context_line":"are invalid after the revocation_cache_time."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"System owners should weigh the risk of an attacker using a revoked token"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"da20952f_689c66c0","line":31,"updated":"2015-09-03 22:17:30.000000000","message":"change \"if the check_...\" to \"if check_\" or add \"option\" afterwards.","commit_id":"48369e2c69edc58d3c7aef0e26f75aa2f5c11ba6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f88c7ee7b698caae99e86c8fb29c925f29c11981","unresolved":false,"context_lines":[{"line_number":29,"context_line":"check_revocations_for_cached is disabled then tokens are valid after"},{"line_number":30,"context_line":"caching token_cache_time or the designated expiration given to the token."},{"line_number":31,"context_line":"Otherwise (if the check_revocations_for_cached is enabled) then tokens"},{"line_number":32,"context_line":"are invalid after the revocation_cache_time."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"System owners should weigh the risk of an attacker using a revoked token"},{"line_number":35,"context_line":"versus the performance implications of reducing the token cache lifetime."}],"source_content_type":"application/octet-stream","patch_set":10,"id":"da20952f_28a2eefc","line":32,"updated":"2015-09-03 22:17:30.000000000","message":"change \"invalid\" to \"rejected\"","commit_id":"48369e2c69edc58d3c7aef0e26f75aa2f5c11ba6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f88c7ee7b698caae99e86c8fb29c925f29c11981","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"### Recommended Actions ###"},{"line_number":38,"context_line":"- In the event that PKI (Public Key Infrastructure) is enabled on the keystone"},{"line_number":39,"context_line":"server, the component check_revocations_for_cached should be set to true."},{"line_number":40,"context_line":"- In the event that PKI is not enabled on the keystone server, the component"},{"line_number":41,"context_line":"revocation_cache_time can be utilized to set the time in which cached tokens"},{"line_number":42,"context_line":"become unusable. The default time should be changed from 300 seconds to 10"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"da20952f_c88a5264","line":39,"updated":"2015-09-03 22:17:30.000000000","message":"I don\u0027t think we should recommend that check_revocations_for_cached should be set to true. It\u0027s an option that the deployer can use but it can potentially increase the load on the keystone server.","commit_id":"48369e2c69edc58d3c7aef0e26f75aa2f5c11ba6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d9c220f6e5b5d13a409c00706da5f5ef59e419fd","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"### Recommended Actions ###"},{"line_number":38,"context_line":"- In the event that PKI (Public Key Infrastructure) is enabled on the keystone"},{"line_number":39,"context_line":"server, the component check_revocations_for_cached should be set to true."},{"line_number":40,"context_line":"- In the event that PKI is not enabled on the keystone server, the component"},{"line_number":41,"context_line":"revocation_cache_time can be utilized to set the time in which cached tokens"},{"line_number":42,"context_line":"become unusable. The default time should be changed from 300 seconds to 10"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"da20952f_4bb63cfa","line":39,"in_reply_to":"da20952f_0b404433","updated":"2015-09-03 23:00:03.000000000","message":"I don\u0027t have a recommendation for what to set it to. I wouldn\u0027t recommend setting it on a system. It\u0027s only there for an odd deployment that somebody complained about. I guess if an admin really doesn\u0027t want to hear or argue about tokens being usable from a misguided security guy they can enable it.\n\nThis document should just make admins aware that this option is available.","commit_id":"48369e2c69edc58d3c7aef0e26f75aa2f5c11ba6"},{"author":{"_account_id":12442,"name":"Shellee Aragon","email":"shellee.aragon@milliman.com","username":"shellee.arnold"},"change_message_id":"cecfc99a64eae814bce5f2f5308472dcc595441f","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"### Recommended Actions ###"},{"line_number":38,"context_line":"- In the event that PKI (Public Key Infrastructure) is enabled on the keystone"},{"line_number":39,"context_line":"server, the component check_revocations_for_cached should be set to true."},{"line_number":40,"context_line":"- In the event that PKI is not enabled on the keystone server, the component"},{"line_number":41,"context_line":"revocation_cache_time can be utilized to set the time in which cached tokens"},{"line_number":42,"context_line":"become unusable. The default time should be changed from 300 seconds to 10"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"da20952f_0b404433","line":39,"in_reply_to":"da20952f_c88a5264","updated":"2015-09-03 22:51:45.000000000","message":"In the previous patch, the information you provided seemed to be conducive of setting this field to true. Can you please elaborate as to what you mean? I am now unclear as to what the recommendation is.","commit_id":"48369e2c69edc58d3c7aef0e26f75aa2f5c11ba6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f88c7ee7b698caae99e86c8fb29c925f29c11981","unresolved":false,"context_lines":[{"line_number":40,"context_line":"- In the event that PKI is not enabled on the keystone server, the component"},{"line_number":41,"context_line":"revocation_cache_time can be utilized to set the time in which cached tokens"},{"line_number":42,"context_line":"become unusable. The default time should be changed from 300 seconds to 10"},{"line_number":43,"context_line":"seconds in all releases inclusive of Icehouse and earlier. Releases preceding"},{"line_number":44,"context_line":"Icehouse (Juno and after) have implemented a fix for this which sets the"},{"line_number":45,"context_line":"default timeout to 10 seconds as opposed to 300 seconds."},{"line_number":46,"context_line":"- Review the implications of the default 300 second token lifetime and any"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"da20952f_28c74e99","line":43,"updated":"2015-09-03 22:17:30.000000000","message":"there is a tradeoff in performance so I don\u0027t think we should just recommend changing the value to 10 seconds.","commit_id":"48369e2c69edc58d3c7aef0e26f75aa2f5c11ba6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f88c7ee7b698caae99e86c8fb29c925f29c11981","unresolved":false,"context_lines":[{"line_number":48,"context_line":"If this is unacceptable, reduce the lifetime to reduce the attack window or"},{"line_number":49,"context_line":"disable token caching entirely."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"In order to make the recommended changes alterations will be require initiation"},{"line_number":52,"context_line":"in configuration files. Alterations to this configuration is ultimately at the"},{"line_number":53,"context_line":"discretion of the deployer, however it is strongly recommended that one of the"},{"line_number":54,"context_line":"solutions mentioned above be implemented."}],"source_content_type":"application/octet-stream","patch_set":10,"id":"da20952f_084a8a26","line":51,"updated":"2015-09-03 22:17:30.000000000","message":"remove \"be\" (or otherwise reword this).","commit_id":"48369e2c69edc58d3c7aef0e26f75aa2f5c11ba6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f88c7ee7b698caae99e86c8fb29c925f29c11981","unresolved":false,"context_lines":[{"line_number":57,"context_line":"as a Web Server Gateway Interface component. In this case the auth_token.py is"},{"line_number":58,"context_line":"the target file to be altered."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"Configuration changes should be made in the auth_token.py file, with changes"},{"line_number":61,"context_line":"affecting:"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"revocation_cache_time"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"da20952f_a8527edc","line":60,"updated":"2015-09-03 22:17:30.000000000","message":"remove this stuff... the configuration is done in the services configuration files (e.g., nova.conf).","commit_id":"48369e2c69edc58d3c7aef0e26f75aa2f5c11ba6"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"389f40b30ef5855549b7eadbf31b945753396fe3","unresolved":false,"context_lines":[{"line_number":20,"context_line":"auth_token middleware. These options include token_cache_time,"},{"line_number":21,"context_line":"revocation_cache_time and check_revocations_for_cached, with each option"},{"line_number":22,"context_line":"affecting the different stages of token caching and revocation. Depending"},{"line_number":23,"context_line":"on the configuration  the previously mentioned options an attacker could use"},{"line_number":24,"context_line":"a compromised token for up to token_cache_time seconds before the token"},{"line_number":25,"context_line":"becomes disabled. To mitigate this vulnerability a change was issued in Juno,"},{"line_number":26,"context_line":"where the default Token Revocation List (TRL) lifetime was reduced to 10"}],"source_content_type":"application/octet-stream","patch_set":12,"id":"da20952f_e12e518b","line":23,"updated":"2015-09-04 00:06:13.000000000","message":"i think this is missing a word and a comma, perhaps \"Depending on the configuration of the previously mentioned options, an attacker...\"","commit_id":"76f69e3af9df619eef5b7aecd17402183a1042af"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"389f40b30ef5855549b7eadbf31b945753396fe3","unresolved":false,"context_lines":[{"line_number":20,"context_line":"auth_token middleware. These options include token_cache_time,"},{"line_number":21,"context_line":"revocation_cache_time and check_revocations_for_cached, with each option"},{"line_number":22,"context_line":"affecting the different stages of token caching and revocation. Depending"},{"line_number":23,"context_line":"on the configuration  the previously mentioned options an attacker could use"},{"line_number":24,"context_line":"a compromised token for up to token_cache_time seconds before the token"},{"line_number":25,"context_line":"becomes disabled. To mitigate this vulnerability a change was issued in Juno,"},{"line_number":26,"context_line":"where the default Token Revocation List (TRL) lifetime was reduced to 10"}],"source_content_type":"application/octet-stream","patch_set":12,"id":"da20952f_812755b5","line":23,"updated":"2015-09-04 00:06:13.000000000","message":"there is an extra space between \"configuration\" and \"the\"","commit_id":"76f69e3af9df619eef5b7aecd17402183a1042af"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"389f40b30ef5855549b7eadbf31b945753396fe3","unresolved":false,"context_lines":[{"line_number":20,"context_line":"auth_token middleware. These options include token_cache_time,"},{"line_number":21,"context_line":"revocation_cache_time and check_revocations_for_cached, with each option"},{"line_number":22,"context_line":"affecting the different stages of token caching and revocation. Depending"},{"line_number":23,"context_line":"on the configuration  the previously mentioned options an attacker could use"},{"line_number":24,"context_line":"a compromised token for up to token_cache_time seconds before the token"},{"line_number":25,"context_line":"becomes disabled. To mitigate this vulnerability a change was issued in Juno,"},{"line_number":26,"context_line":"where the default Token Revocation List (TRL) lifetime was reduced to 10"}],"source_content_type":"application/octet-stream","patch_set":12,"id":"da20952f_e1173143","line":23,"updated":"2015-09-04 00:06:13.000000000","message":"there is an extra space between \"configuration\" and \"the\"","commit_id":"76f69e3af9df619eef5b7aecd17402183a1042af"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"389f40b30ef5855549b7eadbf31b945753396fe3","unresolved":false,"context_lines":[{"line_number":22,"context_line":"affecting the different stages of token caching and revocation. Depending"},{"line_number":23,"context_line":"on the configuration  the previously mentioned options an attacker could use"},{"line_number":24,"context_line":"a compromised token for up to token_cache_time seconds before the token"},{"line_number":25,"context_line":"becomes disabled. To mitigate this vulnerability a change was issued in Juno,"},{"line_number":26,"context_line":"where the default Token Revocation List (TRL) lifetime was reduced to 10"},{"line_number":27,"context_line":"seconds and the check_revocations_for_cached option was added. The addition"},{"line_number":28,"context_line":"of a token to a TRL does not guarantee that cached tokens will be rejected"}],"source_content_type":"application/octet-stream","patch_set":12,"id":"da20952f_61a7a10b","line":25,"updated":"2015-09-04 00:06:13.000000000","message":"i don\u0027t think we need a comma after \"Juno\"","commit_id":"76f69e3af9df619eef5b7aecd17402183a1042af"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"389f40b30ef5855549b7eadbf31b945753396fe3","unresolved":false,"context_lines":[{"line_number":26,"context_line":"where the default Token Revocation List (TRL) lifetime was reduced to 10"},{"line_number":27,"context_line":"seconds and the check_revocations_for_cached option was added. The addition"},{"line_number":28,"context_line":"of a token to a TRL does not guarantee that cached tokens will be rejected"},{"line_number":29,"context_line":"considering the operational nature of token  caching. For instance, if the"},{"line_number":30,"context_line":"check_revocations_for_cached is disabled then tokens are valid after"},{"line_number":31,"context_line":"caching token_cache_time or the designated expiration given to the token."},{"line_number":32,"context_line":"Otherwise (if check_revocations_for_cached is enabled) then tokens are rejected"}],"source_content_type":"application/octet-stream","patch_set":12,"id":"da20952f_8183d555","line":29,"updated":"2015-09-04 00:06:13.000000000","message":"extra space between \"token\" and \"caching\"","commit_id":"76f69e3af9df619eef5b7aecd17402183a1042af"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d71f7abc07f3e2a9a47c6e286a0f25c3ae9ebeaf","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Keystone auth_token middleware token and revocation list caching is used"},{"line_number":6,"context_line":"to reduce the load on the keystone service. The default token cache time"},{"line_number":7,"context_line":"is set to 300 seconds and the default token revocation list cache time is"},{"line_number":8,"context_line":"set to 10 seconds. This creates a misleading expectation that revoked tokens"},{"line_number":9,"context_line":"will not be accepted more than 10 seconds after revocation, however the"}],"source_content_type":"application/octet-stream","patch_set":13,"id":"ba15a1d1_6093745c","line":6,"updated":"2015-09-14 21:33:09.000000000","message":"The OSSN starts by referring to \"token cache time\" ... which is fine.","commit_id":"14d298b4c387d9114a1e18f02597c1e81874f17a"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d71f7abc07f3e2a9a47c6e286a0f25c3ae9ebeaf","unresolved":false,"context_lines":[{"line_number":23,"context_line":"on the configuration the previously mentioned options, an attacker could use"},{"line_number":24,"context_line":"a compromised token for up to token_cache_time seconds before the token"},{"line_number":25,"context_line":"becomes disabled. To mitigate this vulnerability a change was issued in Juno"},{"line_number":26,"context_line":"where the default Token Revocation List (TRL) lifetime was reduced to 10"},{"line_number":27,"context_line":"seconds and the check_revocations_for_cached option was added. The addition"},{"line_number":28,"context_line":"of a token to a TRL does not guarantee that cached tokens will be rejected"},{"line_number":29,"context_line":"considering the operational nature of token caching. For instance, if the"}],"source_content_type":"application/octet-stream","patch_set":13,"id":"ba15a1d1_006dd897","line":26,"updated":"2015-09-14 21:33:09.000000000","message":"cache time, not lifetime","commit_id":"14d298b4c387d9114a1e18f02597c1e81874f17a"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d71f7abc07f3e2a9a47c6e286a0f25c3ae9ebeaf","unresolved":false,"context_lines":[{"line_number":33,"context_line":"after the revocation_cache_time."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"System owners should weigh the risk of an attacker using a revoked token"},{"line_number":36,"context_line":"versus the performance implications of reducing the token cache lifetime."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"### Recommended Actions ###"},{"line_number":39,"context_line":"- Review the implications of the default 300 second token lifetime and any"}],"source_content_type":"application/octet-stream","patch_set":13,"id":"ba15a1d1_2001fcae","line":36,"updated":"2015-09-14 21:33:09.000000000","message":"And then here, the term \"lifetime\" suddenly appears when we were talking about \"token cache time\" before. It\u0027s a subtle difference, but it\u0027s confusing.","commit_id":"14d298b4c387d9114a1e18f02597c1e81874f17a"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d71f7abc07f3e2a9a47c6e286a0f25c3ae9ebeaf","unresolved":false,"context_lines":[{"line_number":36,"context_line":"versus the performance implications of reducing the token cache lifetime."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"### Recommended Actions ###"},{"line_number":39,"context_line":"- Review the implications of the default 300 second token lifetime and any"},{"line_number":40,"context_line":"risks associated with the use of revoked tokens for up to that lifetime."},{"line_number":41,"context_line":"If this is unacceptable, reduce the lifetime to reduce the attack window or"},{"line_number":42,"context_line":"disable token caching entirely."}],"source_content_type":"application/octet-stream","patch_set":13,"id":"ba15a1d1_a05d0ceb","line":39,"updated":"2015-09-14 21:33:09.000000000","message":"This is particularly confusing, because the cache time is 300 seconds, not the token lifetime (which defaults to 3600, IIRC).","commit_id":"14d298b4c387d9114a1e18f02597c1e81874f17a"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d71f7abc07f3e2a9a47c6e286a0f25c3ae9ebeaf","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"### Recommended Actions ###"},{"line_number":39,"context_line":"- Review the implications of the default 300 second token lifetime and any"},{"line_number":40,"context_line":"risks associated with the use of revoked tokens for up to that lifetime."},{"line_number":41,"context_line":"If this is unacceptable, reduce the lifetime to reduce the attack window or"},{"line_number":42,"context_line":"disable token caching entirely."},{"line_number":43,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":13,"id":"ba15a1d1_4073d080","line":40,"updated":"2015-09-14 21:33:09.000000000","message":"Again, cache time, not lifetime.","commit_id":"14d298b4c387d9114a1e18f02597c1e81874f17a"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d71f7abc07f3e2a9a47c6e286a0f25c3ae9ebeaf","unresolved":false,"context_lines":[{"line_number":38,"context_line":"### Recommended Actions ###"},{"line_number":39,"context_line":"- Review the implications of the default 300 second token lifetime and any"},{"line_number":40,"context_line":"risks associated with the use of revoked tokens for up to that lifetime."},{"line_number":41,"context_line":"If this is unacceptable, reduce the lifetime to reduce the attack window or"},{"line_number":42,"context_line":"disable token caching entirely."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"### Contacts / References ###"}],"source_content_type":"application/octet-stream","patch_set":13,"id":"ba15a1d1_800fa8e0","line":41,"updated":"2015-09-14 21:33:09.000000000","message":"Again, cache time, not lifetime.","commit_id":"14d298b4c387d9114a1e18f02597c1e81874f17a"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b2f491e2dbf83d1ade46dd63445e7bf811a4d3cf","unresolved":false,"context_lines":[{"line_number":13,"context_line":"unacceptable risk then caching should be disabled."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Affected Services / Software ###"},{"line_number":16,"context_line":"OpenStack Services that use Keystone middleware: Kilo, Juno, Liberty"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"### Discussion ###"},{"line_number":19,"context_line":"There are multiple options for configuring token caching in the keystone"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"ba15a1d1_41cedd63","line":16,"updated":"2015-09-17 17:01:42.000000000","message":"(nit)  I would recommend listing the releases in chronological order.","commit_id":"756d8a2a443b173c6303185ab1df6c65e2cc894f"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b2f491e2dbf83d1ade46dd63445e7bf811a4d3cf","unresolved":false,"context_lines":[{"line_number":22,"context_line":"affecting the different stages of token caching and revocation. Depending"},{"line_number":23,"context_line":"on the configuration the previously mentioned options, an attacker could use"},{"line_number":24,"context_line":"a compromised token for up to token_cache_time seconds before the token"},{"line_number":25,"context_line":"becomes disabled. To mitigate this vulnerability a change was issued in Juno"},{"line_number":26,"context_line":"where the default Token Revocation List (TRL) cache time was reduced to 10"},{"line_number":27,"context_line":"seconds and the check_revocations_for_cached option was added. The addition"},{"line_number":28,"context_line":"of a token to a TRL does not guarantee that cached tokens will be rejected"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"ba15a1d1_8134f549","line":25,"updated":"2015-09-17 17:01:42.000000000","message":"(nit) Add a comma after \u0027vulnerability\u0027.","commit_id":"756d8a2a443b173c6303185ab1df6c65e2cc894f"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b2f491e2dbf83d1ade46dd63445e7bf811a4d3cf","unresolved":false,"context_lines":[{"line_number":36,"context_line":"versus the performance implications of reducing the token cache time."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"### Recommended Actions ###"},{"line_number":39,"context_line":"- Review the implications of the default 300 second token cache time and any"},{"line_number":40,"context_line":"risks associated with the use of revoked tokens for up to that cache time."},{"line_number":41,"context_line":"If this is unacceptable, reduce the cache time to reduce the attack window or"},{"line_number":42,"context_line":"disable token caching entirely."}],"source_content_type":"application/octet-stream","patch_set":14,"id":"ba15a1d1_412a5ddc","line":39,"updated":"2015-09-17 17:01:42.000000000","message":"(nit) Don\u0027t put a hyphen here, as you don\u0027t have a list of recommendations.","commit_id":"756d8a2a443b173c6303185ab1df6c65e2cc894f"}]}