Bug 825870 (CVE-2012-2654)

Summary: CVE-2012-2654 OpenStack Nova security groups fail to be set correctly
Product: [Other] Security Response Reporter: Kurt Seifried <kseifried>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: pbrady, rbryant, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-09-12 18:20:15 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 829439, 829440, 829441    
Bug Blocks:    
Attachments:
Description Flags
Patch for CVE-2012-2654 none

Description Kurt Seifried 2012-05-28 20:28:32 UTC 
From linux distros robert.clark

Title: Security groups fail to be set correctly

Impact: Medium

Reporter: HP Cloud Services hpcs.security

Products: Nova

Affects: All versions

Description:
HP Cloud Services reported a vulnerability in Nova API handling. When a security group is created via the EC2 or OS API's that uses a protocol defined in the incorrect case i.e 'TCP' rather than 'tcp' it causes a later string comparison to fail. This leads to Security Groups not being set correctly. Once the Nova DB has been polluted with the incorrect case any subsequent modifications to the security group will also fail.

Proposed patch:
See attached diff. This proposed patch will be merged to Nova master and stable/diablo/essex branches on public disclosure date.

Database considerations:
The attached diff will make Nova resilient to any protocol case inconsistencies that may be in the Nova DB. Downstream stakeholders may want to consider sanitising their database by forcing all protocol entries to lower case, hardening their DB against any failures of future code that may expect the data to be lower case.

Proposed public disclosure date/time:
Wednesday 6th June 1000 UTC
Comment 1 Kurt Seifried 2012-05-28 20:30:36 UTC 
Created attachment 587284 [details]
Patch for CVE-2012-2654
Comment 2 Kurt Seifried 2012-06-06 18:51:50 UTC 
Created openstack-nova tracking bugs for this issue

Affects: fedora-16 [bug 829439]
Affects: fedora-17 [bug 829440]
Affects: epel-6 [bug 829441]