Bug 1450150 (CVE-2017-7497) - CFME: Dialog for creating cloud volumes does not filter cloud tenants CVE-2017-7497
Summary: CFME: Dialog for creating cloud volumes does not filter cloud tenants CVE-201...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-7497
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1448857 1452867 1452868
Blocks: 1435396 1450147
TreeView+ depends on / blocked
 
Reported: 2017-05-11 16:37 UTC by Kurt Seifried
Modified: 2021-02-17 02:09 UTC (History)
15 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant.
Clone Of:
Environment:
Last Closed: 2017-08-02 19:12:09 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:1601 0 normal SHIPPED_LIVE Important: CFME 5.7.3 security, bug fix and enhancement update 2017-06-28 18:51:52 UTC
Red Hat Product Errata RHSA-2017:1758 0 normal SHIPPED_LIVE Important: Red Hat CloudForms security, bug fix, and enhancement update 2017-08-02 21:23:43 UTC

Description Kurt Seifried 2017-05-11 16:37:08 UTC 
Gellert Kis of Red Hat reports:

Dialog for creating cloud volumes (cinder provider) does not filter cloud tenants for user. In this way users can create storage volumes in any tenant. Not only in their own tenant. This currently affects CFME 5.7.2 and 5.8.0.
Comment 1 Kurt Seifried 2017-05-11 16:37:25 UTC 
Acknowledgments:

Name: Gellert Kis (Red Hat)
Comment 4 errata-xmlrpc 2017-06-28 15:05:59 UTC 
This issue has been addressed in the following products:

  CloudForms Management Engine 5.7

Via RHSA-2017:1601 https://access.redhat.com/errata/RHSA-2017:1601
Comment 5 errata-xmlrpc 2017-08-02 17:35:34 UTC 
This issue has been addressed in the following products:

  CloudForms Management Engine 5.8

Via RHSA-2017:1758 https://access.redhat.com/errata/RHSA-2017:1758
Note You need to log in before you can comment on or make changes to this bug.