Bug 1193638 – CVE-2015-0271 OpenStack dashboard: log file arbitrary file retrieval

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1193638 - (CVE-2015-0271) CVE-2015-0271 OpenStack dashboard: log file arbitrary file retrieval

Summary:	CVE-2015-0271 OpenStack dashboard: log file arbitrary file retrieval

Status:	CLOSED ERRATA

Aliases:	CVE-2015-0271

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	high Severity high
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=important,public=20150305,repo...
Keywords:	Security

Duplicates:	1193491 (view as bug list)
Depends On:	1193739 1193740 1193741
Blocks:	1193492 1193641
	Show dependency tree / graph

Reported:	2015-02-17 14:13 EST by Kurt Seifried
Modified:	2016-04-26 22:22 EDT (History)
CC List:	18 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	It was found that the local log-viewing function of the redhat-access-plugin for OpenStack Dashboard (horizon) did not sanitize user input. An authenticated user could use this flaw to read an arbitrary file with the permissions of the web server.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-04-17 03:40:42 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2015:0645	normal	SHIPPED_LIVE	Important: redhat-access-plugin-openstack security update	2015-03-05 19:28:41 EST
Red Hat Product Errata	RHSA-2015:0840	normal	SHIPPED_LIVE	Important: redhat-access-plugin security update	2015-04-16 13:52:25 EDT
Red Hat Product Errata	RHSA-2015:0841	normal	SHIPPED_LIVE	Important: redhat-access-plugin security update	2015-04-16 13:51:55 EDT

Groups: None (edit)

Description Kurt Seifried 2015-02-17 14:13:37 EST

Sara Perez Merino of SensePost reports:

In the file logs/views.py the logs() call fails to sanitize the path taken when
displaying a file requested by a remote client, allowing any readable file on 
the system to be viewed.

Comment 6 Garth Mollett 2015-02-17 22:04:46 EST

Acknowledgements:

Red Hat would like to thank Sara Perez Merino of SensePost for reporting this issue.

Comment 10 Garth Mollett 2015-02-18 13:54:22 EST

*** Bug 1193491 has been marked as a duplicate of this bug. ***

Comment 12 errata-xmlrpc 2015-03-05 14:30:22 EST

This issue has been addressed in the following products:

  OpenStack 6 for RHEL 7

Via RHSA-2015:0645 https://rhn.redhat.com/errata/RHSA-2015-0645.html

Comment 13 errata-xmlrpc 2015-04-16 09:57:18 EDT

This issue has been addressed in the following products:

  OpenStack 5 for RHEL 6

Via RHSA-2015:0841 https://rhn.redhat.com/errata/RHSA-2015-0841.html

Comment 14 errata-xmlrpc 2015-04-16 09:57:57 EDT

This issue has been addressed in the following products:

  OpenStack 5 for RHEL 7

Via RHSA-2015:0840 https://rhn.redhat.com/errata/RHSA-2015-0840.html

Note You need to log in before you can comment on or make changes to this bug.