Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 23 Jun 2014 11:01:31 -0400
From: Tristan Cacqueray <tristan.cacqueray@...vance.com>
To: oss-security@...ts.openwall.com
Subject: CVE request for vulnerability in OpenStack Neutron, Ceilometer and
 pyCADF library

A vulnerability was discovered in OpenStack (see below). In order to
ensure full traceability, we need a CVE number assigned that we can
attach to further notifications. This issue is already public, although
an advisory was not sent yet.

Title: User token leak to message queue in pyCADF notifier middleware
Reporter: Zhi Kun Liu (IBM)
Products: Neutron    (2014.1 versions up to 2014.1.1)
          Ceilometer (2013.2 versions up to 2013.2.3,
                      2014.1 versions up to 2014.1.1)
          pyCADF library (all versions up to 0.5.0)

Description:
Zhi Kun Liu from IBM reported a vulnerability in the notifier middleware
available in the PyCADF library and formerly copied into Neutron and
Ceilometer code. An attacker with read access to the message queue may
obtain authentication tokens used in REST requests (X_AUTH_TOKEN) that
goes through the notifier middleware. All services using the notifier
middleware configured after the auth_token middleware pipeline are impacted.

References:
https://launchpad.net/bugs/1321080

Thanks in advance,

-- 
Tristan Cacqueray
OpenStack Vulnerability Management Team




[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ