Security Bulletin: IBM Spectrum Scale Object Protocols functionality is affected by security vulnerabilities in OpenStack (CVE-2015-1852 and CVE-2015-7546)

Summary

IBM Spectrum Scale Object Protocols functionality is affected by security vulnerabilities in OpenStack that could allow:

- a man-in-the-middle attack, caused by an error in the api-paste.ini configuration file. A remote attacker could exploit this vulnerability using a specially-crafted handshake to conduct man-in-the-middle attacks to decrypt and modify traffic (CVE-2015-1852)

- a remote attacker to bypass security restrictions, caused by an error when using the PKI or PKIZ token providers. By manipulating the token contents of a revoked token, the revocation check will improperly consider the token as valid. An attacker could exploit this vulnerability using a revoked token to gain unauthorized access to cloud resources (CVE-2015-7546)

Vulnerability Details

CVEID: CVE-2015-1852 DESCRIPTION: OpenStack keystonemiddleware and python-keystoneclient is vulnerable to a man-in-the-middle attack, caused by an error in the api-paste.ini configuration file. A remote attacker could exploit this vulnerability using a specially-crafted handshake to conduct man-in-the-middle attacks to decrypt and modify traffic.
CVSS Base Score: 5.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102669 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N)

CVEID: CVE-2015-7546 DESCRIPTION: OpenStack Keystone and keystonemiddleware could allow a remote attacker to bypass security restrictions, caused by an error when using the PKI or PKIZ token providers. By manipulating the token contents of a revoked token, the revocation check will improperly consider the token as valid. An attacker could exploit this vulnerability using a revoked token to gain unauthorized access to cloud resources.
CVSS Base Score: 6.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/110301 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Affected Products and Versions

IBM Spectrum Scale V4.2.1.0 thru V4.2.2.0

IBM Spectrum Scale V4.2.0.0 thru V4.2.0.4

IBM Spectrum Scale V4.1.1 thru V4.1.1.14

Remediation/Fixes

For IBM Spectrum Scale V4.2.0.0 thru V4.2.0.4 and V4.2.1.0 thru V4.2.2.0, obtain V4.2.2.1, or later, from FixCentral at:
https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Spectrum+Scale&release=4.2.2&platform=All&function=all

or V4.2.3.0, or later, at:

https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Spectrum+Scale&release=4.2.3&platform=All&function=all

For IBM Spectrum Scale V4.1.1 thru V4.1.1.14, obtain V4.1.1.15 from FixCentral at:
https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Spectrum+Scale&release=4.1.1&platform=All&function=all

Workarounds and Mitigations

None