Bug 1059504 – CVE-2013-6491 Openstack nova: qpid SSL configuration

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1059504 - (CVE-2013-6491) CVE-2013-6491 Openstack nova: qpid SSL configuration

Summary:	CVE-2013-6491 Openstack nova: qpid SSL configuration

Status:	CLOSED ERRATA

Aliases:	CVE-2013-6491

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20130322,repor...
Keywords:	Security

Depends On:	996766
Blocks:	1023240
	Show dependency tree / graph

Reported:	2014-01-29 20:46 EST by Garth Mollett
Modified:	2016-04-26 14:32 EDT (History)
CC List:	15 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2014-04-14 20:29:54 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2014:0112	normal	SHIPPED_LIVE	Moderate: openstack-nova security and bug fix update	2014-01-30 19:58:47 EST

Groups: None (edit)

Description Garth Mollett 2014-01-29 20:46:01 EST

JuanFra Rodriguez Cardoso discovered that nova was not correctly enabling SSL parameters when using the qpid client. Enabling "qpid_protocol = ssl" in nova.conf would not result in SSL being used to commnicate to qpid. If qpid was not configured to enforce SSL this could lead to sensitive information being sent in the clear.

Comment 1 Rob Crittenden 2014-01-29 21:20:53 EST

I don't think the qpid connection is actually successful, even with require_encryption off, so no data actually flows. Did you do any network tracing to confirm that data goes over the wire unencrypted?

Comment 2 Garth Mollett 2014-01-29 22:54:08 EST

Yes I did. It made the connection and worked as normal (with no ssl) even though
ssl was enabled in the nova.conf.

After applying the patch and restarting nova-compute it fails to connect to qpid
(as I had not setup certificate etc.. in qpid).

Comment 3 Garth Mollett 2014-01-29 23:46:56 EST

So looking at the code. The Connection class in qpid.messaging has no
attribute named "protocol". So in the nova qpid rpc implementation without the
patch, all that is happening is a new str attribute called "protocol" is getting
created and is then ignored.

A regular tcp connection is made as the transport attribute is still set to
'tcp' which is the default.

Comment 4 Garth Mollett 2014-01-29 23:59:50 EST

Upstream bug report:

https://bugs.launchpad.net/oslo/+bug/1158807

Comment 5 Rob Crittenden 2014-01-30 09:17:34 EST

Ok, I see what you're saying. If you just set protocol to ssl it is basically a no-op. A user may not know to change the port as well.

Comment 6 errata-xmlrpc 2014-01-30 15:00:41 EST

This issue has been addressed in following products:

  OpenStack 3 for RHEL 6

Via RHSA-2014:0112 https://rhn.redhat.com/errata/RHSA-2014-0112.html

Note You need to log in before you can comment on or make changes to this bug.