Bug 1470414 (CVE-2017-7517)

Summary:	CVE-2017-7517 OSE 3: Metrics accessible from reused project name
Product:	[Other] Security Response	Reporter:	Kurt Seifried <kseifried>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	bleanhar, ccoleman, dedgar, dmcphers, jgoulding, joelsmith
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An input validation vulnerability exists in Openshift Enterprise due to a 1:1 mapping of tenants in Hawkular Metrics and projects/namespaces in OpenShift. If a user creates a project called "MyProject", and then later deletes it another user can then create a project called "MyProject" and access the metrics stored from the original "MyProject" instance.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-21 11:54:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1440970, 1470415, 1470416, 1470417, 1470418, 1479989, 1479992
Bug Blocks:	1445265

Description Kurt Seifried 2017-07-13 00:11:06 UTC

A user can create a project named "myProject", use that project for a while and then delete it. After the original project is deleted, another user can create a project called "myProject". Since the subjectaccessreview will now pass for this second user, they will be able to access metrics from the original project.

Comment 2 Kurt Seifried 2017-07-13 00:15:28 UTC

Acknowledgments:

Name: Matt Wringe (Red Hat)