Bug 1273698 (CVE-2015-5306)

Summary:	CVE-2015-5306 openstack-ironic-discoverd: potential remote code execution with debug mode enabled
Product:	[Other] Security Response	Reporter:	Garth Mollett <gmollett>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abaron, aortega, apevec, ayoung, chrisw, dallan, dtantsur, gkotton, jrusnack, jschluet, jtrowbri, lhh, lpeer, markmc, mburns, rbryant, rhel-osp-director-maint, rhos-maint, sclewis, slong, tdecacqu
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	It was discovered that enabling debug mode in openstack-ironic-discoverd also enabled debug mode in the underlying Flask framework. If errors were encountered while Flask was in debug mode, a user experiencing an error might be able to access the debug console (effectively, a command shell).	Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-01-04 05:18:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1272931, 1273701, 1288252
Bug Blocks:	1273195

Description Garth Mollett 2015-10-21 05:04:42 UTC

It was discovered that enabling debug mode in ironic-discoverd would also enable debug mode in flask, which would in turn enable the flask console on error. An attacker able to trigger an error and expose the flask console could use the console to run arbitary python code.

Comment 1 Garth Mollett 2015-10-21 05:17:56 UTC

Created openstack-ironic-discoverd tracking bugs for this issue:

Affects: fedora-all [bug 1273701]

Comment 3 errata-xmlrpc 2015-10-22 19:45:04 UTC

This issue has been addressed in the following products:

  OpenStack 7.0 Director/Manager for RHEL 7

Via RHSA-2015:1929 https://access.redhat.com/errata/RHSA-2015:1929

Comment 4 Fedora Update System 2015-11-12 23:29:43 UTC

openstack-ironic-discoverd-1.1.1-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2015-11-13 01:53:13 UTC

openstack-ironic-discoverd-1.1.1-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Comment 8 errata-xmlrpc 2015-12-21 19:09:23 UTC

This issue has been addressed in the following products:

  OpenStack 6 for RHEL 7

Via RHSA-2015:2685 https://rhn.redhat.com/errata/RHSA-2015-2685.html