Bug 1064589 (CVE-2014-1948)

Summary:	CVE-2014-1948 openstack-glance: Glance Swift store backend password leak
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abaron, akscram, alexander.sakhnov, aortega, apevec, apevec, ayoung, bfilippov, chrisw, dallan, d.busby, eglynn, fpercoco, gkotton, gmollett, itamar, Jan.van.Eldik, jbresnah, jonathansteffan, jose.castro.leon, jrusnack, lhh, lpeer, markmc, mlvov, mmagr, ndipanov, nsantos, p, rbryant, rhos-maint, sclewis, sdake, yeylon
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	openstack-glance 2013.2.2	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-03-07 04:42:26 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1064662, 1064663, 1064665, 1064666
Bug Blocks:	1064590

Description Vincent Danen 2014-02-12 22:48:40 UTC

A flaw was reported [1],[2] in OpenStack Glance 2013.2 versions up to and including 2013.2.1 and is described as follows:


Nikhil Komawar from Rackspace reported an information leak in Glance
logs. The password for the Swift store backend is logged at WARNING
level as part of the URL when authentication to a store fails if
image location is not disabled by policy or the store is a
single-tenant configuration. An attacker with access to the logs
(local shell, log aggregation system access, or accidental leak) may
leverage this vulnerability to elevate privileges and gain direct
full access to the Glance Swift store backend. Only Glance setups
using the Swift store backend are affected.


This has been corrected in upstream git [3] and version 2013.2.2.

[1] http://seclists.org/oss-sec/2014/q1/323
[2] https://bugs.launchpad.net/glance/+bug/1275062
[3] https://git.openstack.org/cgit/openstack/glance/commit/?id=108f0e04ad2ed3dc287f1b71b987a7e9d66072ba

Comment 2 Kurt Seifried 2014-02-13 04:18:44 UTC

Created openstack-glance tracking bugs for this issue:

Affects: fedora-19 [bug 1064662]
Affects: fedora-20 [bug 1064663]

Comment 3 Flavio Percoco 2014-02-17 10:59:55 UTC

This issue does not affect stable/grizzly. It was introduced in stable/havana as part of the image location work, hence bz #1064662 should be closed.

Comment 6 errata-xmlrpc 2014-03-04 19:06:36 UTC

This issue has been addressed in following products:

  OpenStack 4 for RHEL 6

Via RHSA-2014:0229 https://rhn.redhat.com/errata/RHSA-2014-0229.html

Comment 7 Fedora Update System 2014-05-13 05:03:38 UTC

openstack-glance-2013.2.3-3.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.