Bug 1633019 - CVE-2018-16856 openstack-octavia: Private keys written to world-readable log files [openstack-14-default]
Summary: CVE-2018-16856 openstack-octavia: Private keys written to world-readable log ...
Keywords:
Status: CLOSED ERRATA
Alias: None
Deadline: 2019-09-26
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-octavia
Version: 14.0 (Rocky)
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: z1
: 14.0 (Rocky)
Assignee: Nir Magnezi
QA Contact: Alexander Stafeyev
URL:
Whiteboard:
Depends On:
Blocks: CVE-2018-16856
TreeView+ depends on / blocked
 
Reported: 2018-09-26 05:28 UTC by Summer Long
Modified: 2022-07-09 12:58 UTC (History)
8 users (show)

Fixed In Version: openstack-octavia-3.0.1-0.20181009115732.c57ae8d.el7ost
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-03-18 13:02:26 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
log image with server_pem (331.54 KB, image/png)
2018-09-26 05:28 UTC, Summer Long
no flags Details


Links
System ID Private Priority Status Summary Last Updated
OpenStack Storyboard 2004606 0 None None None 2018-12-13 14:31:14 UTC
OpenStack gerrit 624954 0 None None None 2018-12-13 10:57:03 UTC
OpenStack gerrit 625059 0 None None None 2018-12-14 15:46:05 UTC
Red Hat Issue Tracker OSP-17408 0 None None None 2022-07-09 12:58:54 UTC
Red Hat Product Errata RHSA-2019:0593 0 None None None 2019-03-18 13:02:31 UTC

Description Summer Long 2018-09-26 05:28:26 UTC
Created attachment 1487003 [details]
log image with server_pem

Description of problem:
In a default Director installation with Octavia: 
* On the controller, Octavia logs are world readable, where /var/log/containers/octavia and /var/log/containers/httpd/octavia-api are both 755 and the logs themselves are 644.

* The /var/log/containers/octavia/worker.log has private key data (see attachment). 

Version-Release number of selected component (if applicable):

How reproducible:
The octavia.yaml file was not modified in the deployment:
openstack overcloud deploy --templates -e /home/stack/templates/node-info.yaml -e /usr/share/openstack-tripleo-heat-templates/environments/services-docker/octavia.yaml -e /home/stack/templates/overcloud_images.yaml --libvirt-type qemu --ntp-server clock.redhat.com

Actual results:
Log files containing sensitive data are world readable.

Expected results:
Log files must not be world readable if sensitive data is included. Ideally, make all log files non-world-readable.

Additional info:
The default debug level was not changed, and was set to: debug=False

Comment 1 Nir Magnezi 2018-10-03 14:00:43 UTC
I will look into it.
We can either change the file permissions or prevent from those prints to happen to begin with (maybe only in debug mode?).

Comment 5 Sam Fowler 2018-11-13 03:37:42 UTC
A change was made (new impact, public date, or CSAw status) to the security issue(s) blocked by this tracker, resulting in a new SLA deadline. This bug must now be resolved by 26-Sep-2019.

Refer to this bug's Description for information about how to resolve this bug.

Comment 6 Nir Magnezi 2018-12-04 14:04:51 UTC
Summer,

I'm looking into this problem now, tried to reproduce it but by simply creating load balancers but for some reason, it does not show any key.

1. Do you happen to have the actual log files or the sosreport?
2. Did you do anything other than creating a load balancer to see those keys?

Comment 7 Nir Magnezi 2018-12-04 14:08:55 UTC
(In reply to Nir Magnezi from comment #6)
> Summer,
> 
> I'm looking into this problem now, tried to reproduce it but by simply
> creating load balancers but for some reason, it does not show any key.
> 
> 1. Do you happen to have the actual log files or the sosreport?
> 2. Did you do anything other than creating a load balancer to see those keys?

Actually, I just recalled we had that in an email exchange, so please disregard for now.

Comment 19 Alexander Stafeyev 2019-02-10 10:03:08 UTC
Happens on active/standby octavia configuration only.

Comment 27 errata-xmlrpc 2019-03-18 13:02:26 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:0593


Note You need to log in before you can comment on or make changes to this bug.