CVE-2019-17134 – openstack-octavia: amphora-agent not requiring client certificate

https://notcve.org/view.php?id=CVE-2019-17134

Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the cmd/agent.py gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED. Amphora Images en OpenStack Octavia versiones posteriores e incluyendo a 0.10.0 anteriores a 2.1.2, versiones posteriores e incluyendo a 3.0.0 anteriores a 3.2.0, versiones posteriores e incluyendo a 4.0.0 anteriores a 4.1.0, permite a cualquier persona con acceso a la red de administración omitir la autenticación basada en el certificado del cliente y recuperar información o emitir comandos de configuración mediante peticiones HTTP simples hacia el Agente sobre el puerto https/9443, porque la opción gunicorn cert_reqs del archivo cmd/agent.py es True pero se supone que es ssl.CERT_REQUIRED. A certificate-validation error has been found in Octavia's amphora-agent, where an attacker with management-network access could bypass an amphora's client-certificate based authentication. Because the agent's HTTP server (gunicorn) had 'cert_reqs' set to 'True' instead of 'ssl.CERT_REQUIRED', information could be retrieved or configuration updated without a client certificate. • https://access.redhat.com/errata/RHSA-2019:3743 https://access.redhat.com/errata/RHSA-2019:3788 https://access.redhat.com/errata/RHSA-2020:0721 https://review.opendev.org/686541 https://review.opendev.org/686543 https://review.opendev.org/686544 https://review.opendev.org/686545 https://review.opendev.org/686546 https://review.opendev.org/686547 https://security.openstack.org/ossa/OSSA-2019-005.html https://storyboard.openstack.org/#%21/story/2006660 https://usn. • CWE-287: Improper Authentication CWE-471: Modification of Assumed-Immutable Data (MAID) •