[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 04 May 2012 20:31:41 -0400
From: Russell Bryant <rbryant@...hat.com>
To: "openstack@...ts.launchpad.net" <openstack@...ts.launchpad.net>,
oss-security@...ts.openwall.com
Subject: [OSSA 2012-006] Horizon session fixation and reuse
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
OpenStack Security Advisory: 2012-006
CVE: 2012-05-04
Date: Friday, May 4
Title: Horizon session fixation and reuse
Impact: Critical
Reporter: Thomas Biege, SUSE
Products: Horizon
Affects: All versions
Description:
Thomas Biege from SUSE reported a vulnerability in OpenStack Dashboard
(Horizon). Under specific circumstances it is possible to reuse
session cookies from another user, potentially allowing access to
unauthorized information and capabilities.
Fixes:
Folsom:
https://github.com/openstack/horizon/commit/041b1c44c7d6cf5429505067c32f8f35166a8bab
2012.1:
https://github.com/openstack/horizon/commit/abc532fa90eac1cc970423339347e318aa8d1b1a
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-2144
https://bugs.launchpad.net/horizon/+bug/978896
Notes:
This fix will be included in the folsom-1 development milestone and in
a future 2012.1 (essex) release.
- --
Russell Bryant
OpenStack Vulnerability Management Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk+kdO0ACgkQFg9ft4s9SAYLsgCgptN3zZrEpOCPsbbSfPiPz7J5
BegAoK2D0D1YHP08xt3iSdGQ7OKXuyLT
=CYxN
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
