Bug 1112945 (CVE-2014-4615)
| Summary: | CVE-2014-4615 pycadf: token leak to message queue | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Murray McAllister <mmcallis> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | abaron, aortega, apevec, apevec, ayoung, breu, chrisw, dallan, gkotton, gmollett, ihrachys, itamar, Jan.van.Eldik, jlibosva, jose.castro.leon, jrusnack, jruzicka, lhh, majopela, markmc, mmagr, nyechiel, pbrady, p, rbryant, rhos-maint, rk, sclewis, slinaber, twilson, vdanen, yeylon |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
It was found that authentication tokens were not properly sanitized from the message queue by the notifier middleware. An attacker with read access to the message queue could possibly use this flaw to intercept an authentication token and gain elevated privileges. Note that all services using the notifier middleware configured after the auth_token middleware pipeline were affected.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-08-13 02:06:12 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1112947, 1112948, 1112949, 1113373, 1113374, 1113375, 1113376, 1113377, 1113378, 1126310 | ||
| Bug Blocks: | 1112950 | ||
Created openstack-ceilometer tracking bugs for this issue: Affects: fedora-all [bug 1112949] Created python-pycadf tracking bugs for this issue: Affects: fedora-20 [bug 1112947] How about RHOSP 5 tracker bugs? (In reply to Ihar Hrachyshka from comment #4) > How about RHOSP 5 tracker bugs? Done. IssueDescription: It was found that authentication tokens were not properly sanitized from the message queue by the notifier middleware. An attacker with read access to the message queue could possibly use this flaw to intercept an authentication token and gain elevated privileges. Note that all services using the notifier middleware configured after the auth_token middleware pipeline were affected. This issue has been addressed in following products: OpenStack 4 for RHEL 6 Via RHSA-2014:1050 https://rhn.redhat.com/errata/RHSA-2014-1050.html |
The OpenStack project reports: "" Title: User token leak to message queue in pyCADF notifier middleware Reporter: Zhi Kun Liu (IBM) Products: Neutron (2014.1 versions up to 2014.1.1) Ceilometer (2013.2 versions up to 2013.2.3, 2014.1 versions up to 2014.1.1) pyCADF library (all versions up to 0.5.0) Description: Zhi Kun Liu from IBM reported a vulnerability in the notifier middleware available in the PyCADF library and formerly copied into Neutron and Ceilometer code. An attacker with read access to the message queue may obtain authentication tokens used in REST requests (X_AUTH_TOKEN) that goes through the notifier middleware. All services using the notifier middleware configured after the auth_token middleware pipeline are impacted. ""