CVE-2014-4615 The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo...
MediumCVSS 5.0
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ceilometer(Debian:12) | < 2014.1.2-1 | 2014.1.2-1 |
| debian/ceilometer(Debian:13) | < 2014.1.2-1 | 2014.1.2-1 |
| debian/ceilometer(Debian:14) | < 2014.1.2-1 | 2014.1.2-1 |
| debian/neutron(Debian:12) | < 2014.1.2-1 | 2014.1.2-1 |
| debian/neutron(Debian:13) | < 2014.1.2-1 | 2014.1.2-1 |
| debian/neutron(Debian:14) | < 2014.1.2-1 | 2014.1.2-1 |
| debian/python-pycadf(Debian:12) | < 0.5.1-1 | 0.5.1-1 |
| debian/python-pycadf(Debian:13) | < 0.5.1-1 | 0.5.1-1 |
| debian/python-pycadf(Debian:14) | < 0.5.1-1 | 0.5.1-1 |
| redhat openstack | = 4.0 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| OpenStack Neutron | = 2014.1 | No fix listed |
| OpenStack Neutron | = 2014.1.1 | No fix listed |
| OpenStack Neutron | = juno1 | No fix listed |
| OpenStack oslo | All versions | No fix listed |
| OpenStack pycadf | <= 0.5.0 | No fix listed |
| OpenStack pycadf | = 0.1 | No fix listed |
| OpenStack pycadf | = 0.1.1 | No fix listed |
| OpenStack pycadf | = 0.1.2 | No fix listed |
| OpenStack pycadf | = 0.1.3 | No fix listed |
| OpenStack pycadf | = 0.1.4 | No fix listed |
| OpenStack pycadf | = 0.1.5 | No fix listed |
| OpenStack pycadf | = 0.1.6 | No fix listed |
| OpenStack pycadf | = 0.1.7 | No fix listed |
| OpenStack pycadf | = 0.1.8 | No fix listed |
Show 10 more
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenStack pycadf | = 0.1.9 | No fix listed |
| OpenStack pycadf | = 0.2 | No fix listed |
| OpenStack pycadf | = 0.2.1 | No fix listed |
| OpenStack pycadf | = 0.2.2 | No fix listed |
| OpenStack pycadf | = 0.3 | No fix listed |
| OpenStack pycadf | = 0.3.1 | No fix listed |
| OpenStack pycadf | = 0.4 | No fix listed |
| OpenStack pycadf | = 0.4.1 | No fix listed |
| OpenStack telemetry ceilometer | = 2013.2 | No fix listed |
| OpenStack telemetry ceilometer | = 2014.1 | No fix listed |
References
- Debian Security Tracker CVE-2014-4615 vendor-advisory
- RHSA-2014:1050 vendor-advisory
- 60643 third-party-advisory
- 60736 third-party-advisory
- 60766 third-party-advisory
- [oss-security] 20140623 CVE request for vulnerability in OpenStack Neutron, Ceilometer and pyCADF library mailing-list
- [oss-security] 20140624 Re: CVE request for vulnerability in OpenStack Neutron, Ceilometer and pyCADF library mailing-list
- [oss-security] 20140625 [OSSA 2014-021] User token leak to message queue in pyCADF notifier middleware (CVE-2014-4615) mailing-list
- 68149 vdb-entry
- USN-2311-1 vendor-advisory