Debian: DSA-3953-1: aodh security update
Debian: DSA-3953-1: aodh security update
Zane Bitter from Red Hat discovered a vulnerability in Aodh, the alarm engine for OpenStack. Aodh does not verify that the user creating the alarm is the trustor or has the same rights as the trustor, nor that the trust is for the same project as the alarm. The bug allows that an
- ------------------------------------------------------------------------- Debian Security Advisory DSA-3953-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Luciano Bello August 23, 2017 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : aodh CVE ID : CVE-2017-12440 Debian Bug : 872605 Zane Bitter from Red Hat discovered a vulnerability in Aodh, the alarm engine for OpenStack. Aodh does not verify that the user creating the alarm is the trustor or has the same rights as the trustor, nor that the trust is for the same project as the alarm. The bug allows that an authenticated users without a Keystone token with knowledge of trust IDs to perform unspecified authenticated actions by adding alarm actions. For the stable distribution (stretch), this problem has been fixed in version 3.0.0-4+deb9u1. We recommend that you upgrade your aodh packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.