Security update for openstack-aodh SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2627-1 Final 1 1 2017-10-02T18:07:05Z current 2017-10-02T18:07:05Z 2017-10-02T18:07:05Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openstack-aodh This update for openstack-aodh fixes the following security issues: - CVE-2017-12440: Aodh did not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allowed remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee (bsc#1052604). - gnocchi: Fix alarms for unprivileged user. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-7-2017-1624 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172627-1/ Link for SUSE-SU-2017:2627-1 https://lists.suse.com/pipermail/sle-security-updates/2017-October/003272.html E-Mail link for SUSE-SU-2017:2627-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1052604 SUSE Bug 1052604 https://www.suse.com/security/cve/CVE-2017-12440/ SUSE CVE CVE-2017-12440 page SUSE OpenStack Cloud 7 openstack-aodh-3.0.4~a0~dev1-2.3.1 openstack-aodh-api-3.0.4~a0~dev1-2.3.1 openstack-aodh-doc-3.0.4~a0~dev1-2.3.1 openstack-aodh-evaluator-3.0.4~a0~dev1-2.3.1 openstack-aodh-expirer-3.0.4~a0~dev1-2.3.1 openstack-aodh-listener-3.0.4~a0~dev1-2.3.1 openstack-aodh-notifier-3.0.4~a0~dev1-2.3.1 python-aodh-3.0.4~a0~dev1-2.3.1 openstack-aodh-3.0.4~a0~dev1-2.3.1 as a component of SUSE OpenStack Cloud 7 openstack-aodh-api-3.0.4~a0~dev1-2.3.1 as a component of SUSE OpenStack Cloud 7 openstack-aodh-doc-3.0.4~a0~dev1-2.3.1 as a component of SUSE OpenStack Cloud 7 openstack-aodh-evaluator-3.0.4~a0~dev1-2.3.1 as a component of SUSE OpenStack Cloud 7 openstack-aodh-expirer-3.0.4~a0~dev1-2.3.1 as a component of SUSE OpenStack Cloud 7 openstack-aodh-listener-3.0.4~a0~dev1-2.3.1 as a component of SUSE OpenStack Cloud 7 openstack-aodh-notifier-3.0.4~a0~dev1-2.3.1 as a component of SUSE OpenStack Cloud 7 python-aodh-3.0.4~a0~dev1-2.3.1 as a component of SUSE OpenStack Cloud 7 Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee. CVE-2017-12440 SUSE OpenStack Cloud 7:openstack-aodh-3.0.4~a0~dev1-2.3.1 SUSE OpenStack Cloud 7:openstack-aodh-api-3.0.4~a0~dev1-2.3.1 SUSE OpenStack Cloud 7:openstack-aodh-doc-3.0.4~a0~dev1-2.3.1 SUSE OpenStack Cloud 7:openstack-aodh-evaluator-3.0.4~a0~dev1-2.3.1 SUSE OpenStack Cloud 7:openstack-aodh-expirer-3.0.4~a0~dev1-2.3.1 SUSE OpenStack Cloud 7:openstack-aodh-listener-3.0.4~a0~dev1-2.3.1 SUSE OpenStack Cloud 7:openstack-aodh-notifier-3.0.4~a0~dev1-2.3.1 SUSE OpenStack Cloud 7:python-aodh-3.0.4~a0~dev1-2.3.1 moderate 3.8 AV:A/AC:M/Au:S/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172627-1/ https://www.suse.com/security/cve/CVE-2017-12440.html CVE-2017-12440 https://bugzilla.suse.com/1052604 SUSE Bug 1052604