Bug 1478834 (CVE-2017-12440)

Summary:	CVE-2017-12440 openstack-aodh: Aodh can be used to launder Keystone trusts
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	apevec, chrisw, cvsbot-xmlrpc, eglynn, jjoyce, jschluet, kbasil, lhh, lpeer, lsvaty, markmc, mburns, mgarciac, pgrist, rbryant, rhos-maint, sclewis, security-response-team, slinaber, slong, tdecacqu
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A verification flaw was found in openstack-aodh. As part of an HTTP alarm action, a user could pass in a trust ID. However, the trust could be from anyone because it was not verified. Because the trust was then used by openstack-aodh to obtain a keystone token for the alarm action, a malicious user could pass in another person's trust ID and obtain a keystone token containing the delegated authority of that user.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-02-15 05:00:13 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1481613, 1481614, 1481615, 1487978
Bug Blocks:	1478836

Description Andrej Nemec 2017-08-07 09:02:58 UTC

When adding an alarm action with the scheme `trust+http:` Aodh does not
verify that the user creating the alarm is the trustor or has the same
rights as the trustor, not that the trust is for the same project as the
alarm.

Comment 3 Adam Mariš 2017-08-17 14:17:11 UTC

External References:

https://wiki.openstack.org/wiki/OSSN/OSSN-0080

Comment 4 Joshua Padman 2017-09-04 01:42:09 UTC

Created openstack-aodh tracking bugs for this issue:

Affects: openstack-rdo [bug 1487978]

Comment 5 errata-xmlrpc 2017-11-15 13:26:31 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 10.0 (Newton)

Via RHSA-2017:3227 https://access.redhat.com/errata/RHSA-2017:3227

Comment 6 Summer Long 2017-11-28 23:33:52 UTC

Acknowledgments:

Name: the OpenStack project
Upstream: Zane Bitter (Red Hat)

Comment 8 errata-xmlrpc 2018-02-13 16:26:39 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 11.0 (Ocata)

Via RHSA-2018:0315 https://access.redhat.com/errata/RHSA-2018:0315