Bug 1761307 (CVE-2019-17134)

Summary:	CVE-2019-17134 openstack-octavia: amphora-agent not requiring client certificate
Product:	[Other] Security Response	Reporter:	Summer Long <slong>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	cgoncalves, dbecker, jjoyce, jschluet, kbasil, lhh, lpeer, mburns, ntait, sclewis, slinaber
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	openstack-octavia-2.1.2-1.el7ost, openstack-octavia-4.1.0-1	Doc Type:	If docs needed, set a value
Doc Text:	A certificate-validation error has been found in Octavia's amphora-agent, where an attacker with management-network access could bypass an amphora's client-certificate based authentication. Because the agent's HTTP server (gunicorn) had 'cert_reqs' set to 'True' instead of 'ssl.CERT_REQUIRED', information could be retrieved or configuration updated without a client certificate.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-11-06 18:51:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1761723, 1761724, 1761725
Bug Blocks:	1759738

Description Summer Long 2019-10-14 04:28:50 UTC

From NVD via oss-security: 
Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the cmd/agent.py gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED.

Patches
- https://review.opendev.org/686547 (Ocata)
- https://review.opendev.org/686546 (Pike)
- https://review.opendev.org/686545 (Queens)
- https://review.opendev.org/686544 (Rocky)
- https://review.opendev.org/686543 (Stein)
- https://review.opendev.org/686541 (Train)
https://security.openstack.org/ossa/OSSA-2019-005.html
https://storyboard.openstack.org/#!/story/2006660
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17134

Comment 2 Summer Long 2019-10-15 07:28:32 UTC

External References:

https://security.openstack.org/ossa/OSSA-2019-005.html

Comment 4 Summer Long 2019-10-16 06:34:00 UTC

Mitigation:

There is no mitigation for this issue, the flaw can only be resolved by applying updates.

Comment 8 errata-xmlrpc 2019-11-06 15:20:24 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 14.0 (Rocky)

Via RHSA-2019:3743 https://access.redhat.com/errata/RHSA-2019:3743

Comment 9 Product Security DevOps Team 2019-11-06 18:51:10 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-17134

Comment 10 errata-xmlrpc 2019-11-07 13:51:52 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 13.0 (Queens)

Via RHSA-2019:3788 https://access.redhat.com/errata/RHSA-2019:3788

Comment 11 errata-xmlrpc 2020-03-05 11:58:20 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 15.0 (Stein)

Via RHSA-2020:0721 https://access.redhat.com/errata/RHSA-2020:0721