[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 18 May 2015 17:01:06 -0600
From: Colton Myers <colton@...tstack.com>
To: Michael Scherer <misc@...b.org>
Cc: oss-security@...ts.openwall.com, security@...tstack.com
Subject: Re: [saltstack-security] CVE Request / Saltstack SSL verification
disabling for alibabab cloud module
CVE was assigned off list:
CVE-2015-4017 -- Certificates are not verified when connecting to server in
the Aliyun and Proxmox modules
And fixed in the just-released 2014.7.6:
https://groups.google.com/forum/#!topic/salt-users/8Kv1bytGD6c
The splunk module vulnerability was not in a released version of salt, so
there is no CVE for that module. It was fixed before the 2015.5.0 release.
Please note that we have a responsible disclosure policy, and would
appreciate it if it were followed in the future:
http://docs.saltstack.com/en/latest/security/index.html#disclosure
--
Colton Myers
Platform Engineer, SaltStack
@basepi on Twitter/Github/IRC
On Fri, May 1, 2015 at 8:10 PM, Michael Scherer <misc@...b.org> wrote:
> Hi,
>
> Could a CVE be assigned for this problem :
>
> Saltstack do not verify certificate when connecting to Aliyun (Alibaba
> cloud service)
> API on HTTPS
>
> https://github.com/saltstack/salt/blob/develop/salt/cloud/clouds/aliyun.py#L724
>
>
> The same issue exist for the proxmox module :
>
> https://github.com/saltstack/salt/blob/develop/salt/cloud/clouds/proxmox.py#L115
>
> And splunk:
>
> https://github.com/saltstack/salt/blob/develop/salt/modules/splunk_search.py#L168
>
>
> This was found by running bandit on the source code
> ( https://wiki.openstack.org/wiki/Security/Projects/Bandit )
> --
> Michael Scherer
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
