Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Red Hat Enterprise: RHSA-2016:0440-01 Moderate: openstack-heat DoS Risk

red hat
Calendar Grey March 14, 2016
Scroller Redhat
OpenShift issues a critical security notice concerning Kubernetes Service, rectifying vulnerabilities and highlighting a newly discovered flaw.
Updated OpenStack Orchestration packages that fix one security issue and two bugs are now available for Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Summary

OpenStack Orchestration (heat) is a template-driven engine used to specify and deploy configurations for Compute, Storage, and OpenStack Networking. It can also be used to automate post-deployment actions, which in turn allows automated provisioning of infrastructure, services, and applications. Orchestration can also be integrated with Telemetry alarms to implement auto-scaling for certain infrastructure resources.
A vulnerability was discovered in the OpenStack Orchestration service (heat), where a specially formatted template could be used to trick the heat-engine service into opening a local file. Although the file contents are never disclosed to the end user, an OpenStack- authenticated attacker could use this flaw to cause a denial of service or determine whether a given file name is present on the server. (CVE-2015-5295)
This issue was discovered by Steven Hardy of Red Hat.

Topics%20covered

Topics Covered

security advisory DoS issue bug fix Red Hat Enterprise Linux moderate severity OpenStack Orchestration heat engine

References

https://access.redhat.com/security/cve/CVE-2015-5295 https://access.redhat.com/security/updates/classification#moderate

Package List

Red Hat Enterprise Linux OpenStack Platform 5.0 for RHEL 6:
Source: openstack-heat-2014.1.5-7.el6ost.src.rpm
noarch: openstack-heat-api-2014.1.5-7.el6ost.noarch.rpm openstack-heat-api-cfn-2014.1.5-7.el6ost.noarch.rpm openstack-heat-api-cloudwatch-2014.1.5-7.el6ost.noarch.rpm openstack-heat-common-2014.1.5-7.el6ost.noarch.rpm openstack-heat-engine-2014.1.5-7.el6ost.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key


Advisory ID: RHSA-2016:0440-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2016:0440.html
Issue date: 2016-03-14

Topic

Updated OpenStack Orchestration packages that fix one security issue andtwo bugs are now available for Red Hat Enterprise Linux OpenStackPlatform 5.0 (Icehouse) for RHEL 6.Red Hat Product Security has rated this update as having Moderate securityimpact. Common Vulnerability Scoring System (CVSS) base scores, which givedetailed severity ratings, are available for each vulnerability from theCVE links in the References section.

Topics%20covered

Topics Covered

security advisory DoS issue bug fix Red Hat Enterprise Linux moderate severity OpenStack Orchestration heat engine

Relevant Releases Architectures

Red Hat Enterprise Linux OpenStack Platform 5.0 for RHEL 6 - noarch

Bugs Fixed

1298295 - CVE-2015-5295 openstack-heat: Vulnerability in Heat template validation leading to DoS

1304075 - [heat] oslo.messaging holds connections when replies fail

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.