Bug 1478834 (CVE-2017-12440) - CVE-2017-12440 openstack-aodh: Aodh can be used to launder Keystone trusts
Summary: CVE-2017-12440 openstack-aodh: Aodh can be used to launder Keystone trusts
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-12440
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1481613 1481614 1481615 1487978
Blocks: 1478836
TreeView+ depends on / blocked
 
Reported: 2017-08-07 09:02 UTC by Andrej Nemec
Modified: 2021-02-17 01:46 UTC (History)
17 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A verification flaw was found in openstack-aodh. As part of an HTTP alarm action, a user could pass in a trust ID. However, the trust could be from anyone because it was not verified. Because the trust was then used by openstack-aodh to obtain a keystone token for the alarm action, a malicious user could pass in another person's trust ID and obtain a keystone token containing the delegated authority of that user.
Clone Of:
Environment:
Last Closed: 2018-02-15 05:00:13 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:3227 0 normal SHIPPED_LIVE Moderate: openstack-aodh security update 2017-11-15 18:25:52 UTC
Red Hat Product Errata RHSA-2018:0315 0 normal SHIPPED_LIVE Moderate: openstack-aodh security update 2018-02-14 00:22:45 UTC

Description Andrej Nemec 2017-08-07 09:02:58 UTC 
When adding an alarm action with the scheme `trust+http:` Aodh does not
verify that the user creating the alarm is the trustor or has the same
rights as the trustor, not that the trust is for the same project as the
alarm.
Comment 3 Adam Mariš 2017-08-17 14:17:11 UTC 
External References:

https://wiki.openstack.org/wiki/OSSN/OSSN-0080
Comment 4 Joshua Padman 2017-09-04 01:42:09 UTC 
Created openstack-aodh tracking bugs for this issue:

Affects: openstack-rdo [bug 1487978]
Comment 5 errata-xmlrpc 2017-11-15 13:26:31 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 10.0 (Newton)

Via RHSA-2017:3227 https://access.redhat.com/errata/RHSA-2017:3227
Comment 6 Summer Long 2017-11-28 23:33:52 UTC 
Acknowledgments:

Name: the OpenStack project
Upstream: Zane Bitter (Red Hat)
Comment 8 errata-xmlrpc 2018-02-13 16:26:39 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 11.0 (Ocata)

Via RHSA-2018:0315 https://access.redhat.com/errata/RHSA-2018:0315
Note You need to log in before you can comment on or make changes to this bug.