Bug 1346193 (CVE-2016-4985) - CVE-2016-4985 openstack-ironic: Ironic Node information including credentials exposed to unauthenticated users
Summary: CVE-2016-4985 openstack-ironic: Ironic Node information including credentials...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-4985
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1348038 1348039 1348040 1348041 1348042 1348817 1348818
Blocks: 1346195
TreeView+ depends on / blocked
 
Reported: 2016-06-14 08:56 UTC by Adam Mariš
Modified: 2021-02-17 03:43 UTC (History)
19 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2016-12-15 05:33:31 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:1377 0 normal SHIPPED_LIVE Moderate: openstack-ironic security update 2016-07-04 09:49:29 UTC
Red Hat Product Errata RHSA-2016:1378 0 normal SHIPPED_LIVE Moderate: openstack-ironic security update 2016-07-04 09:49:18 UTC

Description Adam Mariš 2016-06-14 08:56:05 UTC
A client with network access to the ironic-api service can bypass Keystone authentication and retrieve all information about any Node registered with Ironic, if they know (or are able to guess) the MAC address of a network card belonging to that Node, by sending a crafted POST request to the /v1/drivers/$DRIVER_NAME/vendor_passthru resource.

The response will include the full Node details, including management passwords, even when /etc/ironic/policy.json is configured to hide passwords in API responses.

This vulnerability has been verified in all currently supported branches (liberty, mitaka, master) and traced back to code introduced in commit 3e568fbbbcc5748035c1448a0bdb26306470797c during the Juno development cycle. Therefore, it is likely that both juno and kilo branches (and their releases) are also affected.

Affected versions: >=2014.2, >=4.0.0 <=4.2.4, >=4.3.0 <=5.1.1

Comment 1 Adam Mariš 2016-06-14 08:56:14 UTC
Acknowledgments:

Name: the OpenStack Ironic project
Upstream: Devananda van der Veen (IBM)

Comment 6 Summer Long 2016-06-20 04:12:59 UTC
Eric, could you please do a doc text check on this? thanks, Summer

Comment 7 Adam Mariš 2016-06-22 07:18:09 UTC
Public via:

http://seclists.org/oss-sec/2016/q2/579

Comment 8 Adam Mariš 2016-06-22 07:21:21 UTC
Created openstack-ironic tracking bugs for this issue:

Affects: openstack-rdo [bug 1348817]

Comment 9 Adam Mariš 2016-06-22 07:21:31 UTC
Created openstack-ironic tracking bugs for this issue:

Affects: fedora-all [bug 1348818]

Comment 13 errata-xmlrpc 2016-07-04 05:49:37 UTC
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 8.0 (Liberty)

Via RHSA-2016:1378 https://access.redhat.com/errata/RHSA-2016:1378

Comment 14 errata-xmlrpc 2016-07-04 05:49:57 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7

Via RHSA-2016:1377 https://access.redhat.com/errata/RHSA-2016:1377


Note You need to log in before you can comment on or make changes to this bug.