oss-security - [OSSA 2014-021] User token leak to message queue in pyCADF notifier middleware (CVE-2014-4615)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <53AB1F3E.9070202@enovance.com>
Date: Wed, 25 Jun 2014 15:13:02 -0400
From: Tristan Cacqueray <tristan.cacqueray@...vance.com>
To: oss-security@...ts.openwall.com
Subject: [OSSA 2014-021] User token leak to message queue in pyCADF notifier
 middleware (CVE-2014-4615)

OpenStack Security Advisory: 2014-021
CVE: CVE-2014-4615
Date: June 25, 2014
Title: User token leak to message queue in pyCADF notifier middleware
Reporter: Zhi Kun Liu (IBM)
Products: Neutron    (2014.1 versions up to 2014.1.1)
          Ceilometer (2013.2 versions up to 2013.2.3,
                      2014.1 versions up to 2014.1.1)
          pyCADF library (all versions up to 0.5.0)

Description:
Zhi Kun Liu from IBM reported a vulnerability in the notifier middleware
available in the PyCADF library and formerly copied into Neutron and
Ceilometer code. An attacker with read access to the message queue may
obtain authentication tokens used in REST requests (X_AUTH_TOKEN) that
goes through the notifier middleware. All services using the notifier
middleware configured after the auth_token middleware pipeline are impacted.

pyCADF fix (included in 0.5.1 release):
https://review.openstack.org/94878      (pyCADF)

Juno (development branch) fix:
https://review.openstack.org/94891      (Neutron)

Icehouse fix:
https://review.openstack.org/101097     (Neutron)
https://review.openstack.org/96944      (Ceilometer)

Havana fix:
https://review.openstack.org/101799     (Ceilometer)

Notes:
Ceilometer Juno (master) branch is not affected.
Those fixes will be included in the Juno-2 development milestone and in
future 2013.2.4 and 2014.1.2 releases.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4615
https://launchpad.net/bugs/1321080

-- 
Tristan Cacqueray
OpenStack Vulnerability Management Team

Download attachment "signature.asc" of type "application/pgp-signature" (539 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.