oss-security - [OSSA-2019-005] Octavia Amphora-Agent not requiring Client-Certificate (CVE-2019-17134)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <23864967-5f4e-f048-7ea7-553f72a2746e@preussker.net>
Date: Tue, 8 Oct 2019 11:24:09 +0200
From: Daniel 'f0o' Preussker <daniel@...ussker.net>
To: oss-security@...ts.openwall.com
Subject: [OSSA-2019-005] Octavia Amphora-Agent not requiring
 Client-Certificate (CVE-2019-17134)

=====================================================================
OSSA-2019-005: Octavia Amphora-Agent not requiring Client-Certificate
=====================================================================

:Date: October 07, 2019
:CVE: CVE-2019-17134


Affects
~~~~~~~
- Octavia: >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0


Description
~~~~~~~~~~~
Daniel Preussker reported a vulnerability in amphora-agent, running
within Octavia Amphora Instances which allows unauthenticated access
from the management network. This leads to information disclosure and
also allows changes to the configuration of the Amphora via simple
HTTP requests because cmd/agent.py gunicorn cert_reqs option is
incorrectly set to True instead of ssl.CERT_REQUIRED.


Patches
~~~~~~~
- https://review.opendev.org/686547 (Ocata)
- https://review.opendev.org/686546 (Pike)
- https://review.opendev.org/686545 (Queens)
- https://review.opendev.org/686544 (Rocky)
- https://review.opendev.org/686543 (Stein)
- https://review.opendev.org/686541 (Train)


Credits
~~~~~~~
- Daniel Preussker (CVE-2019-17134)


References
~~~~~~~~~~
- https://storyboard.openstack.org/#!/story/2006660
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17134


Notes
~~~~~
- The stable/ocata and stable/pike branches are under extended maintenance and
  will receive no new point releases, but patches for them are provided as a
  courtesy.


Content of type "text/html" skipped

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.