Red Hat Bugzilla – Bug 825870
CVE-2012-2654 OpenStack Nova security groups fail to be set correctly
Last modified: 2015-07-31 02:51:23 EDT
From linux distros firstname.lastname@example.org
Title: Security groups fail to be set correctly
Reporter: HP Cloud Services email@example.com
Affects: All versions
HP Cloud Services reported a vulnerability in Nova API handling. When a security group is created via the EC2 or OS API's that uses a protocol defined in the incorrect case i.e 'TCP' rather than 'tcp' it causes a later string comparison to fail. This leads to Security Groups not being set correctly. Once the Nova DB has been polluted with the incorrect case any subsequent modifications to the security group will also fail.
See attached diff. This proposed patch will be merged to Nova master and stable/diablo/essex branches on public disclosure date.
The attached diff will make Nova resilient to any protocol case inconsistencies that may be in the Nova DB. Downstream stakeholders may want to consider sanitising their database by forcing all protocol entries to lower case, hardening their DB against any failures of future code that may expect the data to be lower case.
Proposed public disclosure date/time:
Wednesday 6th June 1000 UTC
Created attachment 587284 [details]
Patch for CVE-2012-2654
Created openstack-nova tracking bugs for this issue
Affects: fedora-16 [bug 829439]
Affects: fedora-17 [bug 829440]
Affects: epel-6 [bug 829441]