Bug 1298295 (CVE-2015-5295)

Summary: CVE-2015-5295 openstack-heat: Vulnerability in Heat template validation leading to DoS
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abaron, aortega, apevec, augol, ayoung, chrisw, cvsbot-xmlrpc, dallan, gkotton, gmollett, jpeeler, jschluet, lhh, lpeer, markmc, mburns, rbryant, sbaker, sclewis, security-response-team, shardy, slong, tdecacqu, yeylon, zbitter
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
A vulnerability was discovered in the OpenStack Orchestration service (heat), where a specially formatted template could be used to trick the heat-engine service into opening a local file. Although the file contents are never disclosed to the end user, an OpenStack-authenticated attacker could use this flaw to cause a denial of service or determine whether a given file name is present on the server.
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-03-14 09:58:35 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1298808, 1298809, 1298810, 1298811, 1298812, 1300090, 1300091    
Bug Blocks: 1298296    
Attachments:
Description Flags
Master/mitaka patch
none
Stable/kilo patch
none
Stable/liberty patch
none
stable/juno patch
none
stable/icehouse patch none

Description Adam Mariš 2016-01-13 16:49:00 UTC
A vulnerability in Heat template validation was reported. By referencing a local file like /dev/zero, an authenticated user may trick the heat engine service to load arbitrary local file content resulting in a Denial of Service attack through memory exhaustion. Note that the file content is not written back to the user, though the user can determine if a file exists and if it is readable by heat-engine.

Affects versions <=2015.1.2, ==5.0.0. All Heat setups are affected.

Comment 1 Adam Mariš 2016-01-13 16:57:17 UTC
Created attachment 1114470 [details]
Master/mitaka patch

Comment 2 Adam Mariš 2016-01-13 16:57:49 UTC
Created attachment 1114471 [details]
Stable/kilo patch

Comment 3 Adam Mariš 2016-01-13 16:58:33 UTC
Created attachment 1114472 [details]
Stable/liberty patch

Comment 5 Zane Bitter 2016-01-14 22:24:53 UTC
Created attachment 1114967 [details]
stable/juno patch

Comment 6 Zane Bitter 2016-01-14 22:25:32 UTC
Created attachment 1114968 [details]
stable/icehouse patch

Comment 9 Garth Mollett 2016-01-19 23:15:05 UTC
Created openstack-heat tracking bugs for this issue:

Affects: fedora-all [bug 1300091]

Comment 10 Fedora Update System 2016-02-02 19:20:06 UTC
openstack-heat-2015.1.2-2.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 11 Garth Mollett 2016-02-11 01:55:03 UTC
Acknowledgements:

This issue was discovered by Steven Hardy of Red Hat.

Comment 12 errata-xmlrpc 2016-02-18 16:42:34 UTC
This issue has been addressed in the following products:

  OpenStack 7 For RHEL 7

Via RHSA-2016:0266 https://rhn.redhat.com/errata/RHSA-2016-0266.html

Comment 13 errata-xmlrpc 2016-03-14 09:24:35 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7

Via RHSA-2016:0442 https://rhn.redhat.com/errata/RHSA-2016-0442.html

Comment 14 errata-xmlrpc 2016-03-14 09:25:17 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7

Via RHSA-2016:0441 https://rhn.redhat.com/errata/RHSA-2016-0441.html

Comment 15 errata-xmlrpc 2016-03-14 09:26:30 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6

Via RHSA-2016:0440 https://rhn.redhat.com/errata/RHSA-2016-0440.html