OSSA-2014-021: User token leak to message queue in pyCADF notifier middleware

Date:

June 25, 2014

CVE:

CVE-2014-4615

Affects

• Neutron: 2014.1 versions up to 2014.1.1

• Ceilometer: 2013.2 versions up to 2013.2.3, 2014.1 versions up to 2014.1.1

Description

Zhi Kun Liu from IBM reported a vulnerability in the notifier middleware available in the PyCADF library and formerly copied into Neutron and Ceilometer code. An attacker with read access to the message queue may obtain authentication tokens used in REST requests (X_AUTH_TOKEN) that goes through the notifier middleware. All services using the notifier middleware configured after the auth_token middleware pipeline are impacted.

Patches

• https://review.openstack.org/#/c/101799 (Havana)

• https://review.openstack.org/#/c/101097 (Icehouse)

• https://review.openstack.org/#/c/96944 (Icehouse)

• https://review.openstack.org/#/c/94891 (Juno)

Credits

• Zhi Kun Liu from IBM (CVE-2014-4615)

References

• https://launchpad.net/bugs/1321080

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4615