RedHatRHSA-2018:0315(RHSA-2018:0315) Moderate: openstack-aodh security update
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
76.3%
openstack-aodh provides the ability to trigger actions based on defined rules against metric or event data collected by OpenStack Telemetry (ceilometer) or Time-Series-Database-as-a-Service (gnocchi).
openstack-aodh has been rebased to the upstream 4.0.2-3 version.
Security Fix(es):
- A verification flaw was found in openstack-aodh. As part of an HTTP alarm action, a user could pass in a trust ID. However, the trust could be from anyone because it was not verified. Because the trust was then used by openstack-aodh to obtain a keystone token for the alarm action, a malicious user could pass in another person’s trust ID and obtain a keystone token containing the delegated authority of that user. (CVE-2017-12440)
Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Zane Bitter (Red Hat) as the original reporter.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| RedHat | 7 | noarch | openstack-aodh-listener | < 4.0.2-3.el7ost | openstack-aodh-listener-4.0.2-3.el7ost.noarch.rpm |
| RedHat | 7 | noarch | python-aodh | < 4.0.2-3.el7ost | python-aodh-4.0.2-3.el7ost.noarch.rpm |
| RedHat | 7 | noarch | openstack-aodh-notifier | < 4.0.2-3.el7ost | openstack-aodh-notifier-4.0.2-3.el7ost.noarch.rpm |
| RedHat | 7 | noarch | python-aodh-tests | < 4.0.2-3.el7ost | python-aodh-tests-4.0.2-3.el7ost.noarch.rpm |
| RedHat | 7 | noarch | openstack-aodh-expirer | < 4.0.2-3.el7ost | openstack-aodh-expirer-4.0.2-3.el7ost.noarch.rpm |
| RedHat | 7 | noarch | openstack-aodh-compat | < 4.0.2-3.el7ost | openstack-aodh-compat-4.0.2-3.el7ost.noarch.rpm |
| RedHat | 7 | noarch | openstack-aodh-api | < 4.0.2-3.el7ost | openstack-aodh-api-4.0.2-3.el7ost.noarch.rpm |
| RedHat | 7 | noarch | openstack-aodh-evaluator | < 4.0.2-3.el7ost | openstack-aodh-evaluator-4.0.2-3.el7ost.noarch.rpm |
| RedHat | 7 | noarch | openstack-aodh-common | < 4.0.2-3.el7ost | openstack-aodh-common-4.0.2-3.el7ost.noarch.rpm |
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
76.3%