OpenStack Heat CFN策略安全绕过漏洞

Bugtraq ID:64243 CVE ID:CVE-2013-6426 OpenStack Heat类似于亚马逊的CloudFormation,它可以基于政策对可能发生的情况定义一个模板。 OpenStack Heat默认API策略实施存在安全漏洞，通过调用CreateStack或UpdateStack方法，in-instance用户可创建或者更新与默认策略相冲突的栈。使用Heat's cloudformation-compatible API的设置受此漏洞影响。 0 OpenStack Heat 2013.x 厂商补丁： OpenStack -----...

OpenStack Heat ReST API校验特权提升漏洞

Bugtraq ID:64257 CVE ID:CVE-2013-6428 OpenStack Heat类似于亚马逊的CloudFormation,它可以基于政策对可能发生的情况定义一个模板。 OpenStack Heat应用没有正确校验通过"tenantid" ReST API参数传递的租户ID，允许远程攻击者可以利用该漏洞伪造其他租户，提升权限。需要知道目标租户ID来利用该漏洞。 0 OpenStack Heat 2013.x 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.openstack.org/...

DEBIAN-CVE-2013-6428

The ReST API in OpenStack Orchestration API Heat before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenantid in the request path...

DEBIAN-CVE-2013-6426

The cloudformation-compatible API in OpenStack Orchestration API Heat before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to bypass intended access restrictions and 1 create a stack via the CreateStack method or 2 upda...

UBUNTU-CVE-2013-6428

The ReST API in OpenStack Orchestration API Heat before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenantid in the request path...

UBUNTU-CVE-2013-6426

The cloudformation-compatible API in OpenStack Orchestration API Heat before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to bypass intended access restrictions and 1 create a stack via the CreateStack method or 2 upda...