PT-2014-6023 · Openstack+1 · Neutron+4

Zhi Kun Liu · Published 2014-06-24 · Updated 2017-01-07 · CVE-2014-4615

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack PyCADF version 0.5.0 and earlier Telemetry (Ceilometer) versions 2013.2 before 2013.2.4 and 2014.x before 2014.1.2 Neutron versions 2014.x before 2014.1.2 and Juno before Juno-2 Oslo (affected versions not specified)

Description The issue allows remote authenticated users to obtain X AUTH TOKEN values by reading the message queue, specifically the v2/meters/http.request endpoint.

Recommendations For OpenStack PyCADF version 0.5.0 and earlier, update to a version later than 0.5.0. For Telemetry (Ceilometer) versions 2013.2 before 2013.2.4, update to version 2013.2.4 or later. For Telemetry (Ceilometer) versions 2014.x before 2014.1.2, update to version 2014.1.2 or later. For Neutron versions 2014.x before 2014.1.2, update to version 2014.1.2 or later. For Neutron Juno before Juno-2, update to Juno-2 or later. For Oslo, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-4615

RHSA-2014:1050

USN-2311-1

USN-2311-2

USN-2321-1

Affected Products

Neutron

Openstack Pycadf

Oslo

Telemetry

Ubuntu

References · 26

• https://osv.dev/vulnerability/USN-2311-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-4615 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3555 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4615 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-4615 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-1050.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2311-2 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2321-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3555 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-4615 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2311-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-4615 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2311-2 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-4615 · Vendor Advisory
• http://ubuntu.com/usn/USN-2311-1 · Vendor Advisory