Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Red Hat OpenStack 10.0 RHSA-2017:3227-01 Moderate Aodh Trust Issue

red hat
Calendar Grey November 16, 2017
Scroller Redhat
A key security enhancement for openstack-heat in Red Hat OpenStack Platform rectifies a vulnerability related to data authenticity.
An update for openstack-aodh is now available for Red Hat OpenStack Platform 10.0 (Newton)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

openstack-aodh provides the ability to trigger actions based on defined rules against metric or event data collected by OpenStack Telemetry (ceilometer) or Time-Series-Database-as-a-Service (gnocchi).
Security Fix(es):
* A verification flaw was found in openstack-aodh. As part of an HTTP alarm action, a user could pass in a trust ID. However, the trust could be from anyone because it was not verified. Because the trust was then used by openstack-aodh to obtain a keystone token for the alarm action, a malicious user could pass in another person's trust ID and obtain a keystone token containing the delegated authority of that user. (CVE-2017-12440)
This issue was discovered by Luke Hinds (Red Hat). Upstream acknowledges Zane Bitter (Red Hat) as the original reporter.

Topics%20covered

Topics Covered

security advisory moderate security update red hat openstack-aodh trust verification

References

https://access.redhat.com/security/cve/CVE-2017-12440 https://access.redhat.com/security/updates/classification/#moderate

Package List

Red Hat OpenStack Platform 10.0:
Source: openstack-aodh-3.0.4-1.el7ost.src.rpm
noarch: openstack-aodh-api-3.0.4-1.el7ost.noarch.rpm openstack-aodh-common-3.0.4-1.el7ost.noarch.rpm openstack-aodh-compat-3.0.4-1.el7ost.noarch.rpm openstack-aodh-evaluator-3.0.4-1.el7ost.noarch.rpm openstack-aodh-expirer-3.0.4-1.el7ost.noarch.rpm openstack-aodh-listener-3.0.4-1.el7ost.noarch.rpm openstack-aodh-notifier-3.0.4-1.el7ost.noarch.rpm python-aodh-3.0.4-1.el7ost.noarch.rpm python-aodh-tests-3.0.4-1.el7ost.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Advisory ID: RHSA-2017:3227-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2017:3227
Issue date: 2017-11-15

Topic

An update for openstack-aodh is now available for Red Hat OpenStackPlatform 10.0 (Newton).Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate security update red hat openstack-aodh trust verification

Relevant Releases Architectures

Red Hat OpenStack Platform 10.0 - noarch

Bugs Fixed

1478834 - CVE-2017-12440 openstack-aodh: Aodh can be used to launder Keystone trusts

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.