CVE-2017-12440 – openstack-aodh: Aodh can be used to launder Keystone trusts

https://notcve.org/view.php?id=CVE-2017-12440

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee. Aodh, tal y como viene en Openstack Ocata y Newton antes de change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 y antes de Pike-rc1, no verifica que las ID de confianza pertenecen al usuario cuando se crean acciones de alarma con el esquema "trust+http", lo que permite a los usuarios autenticados remotos con conocimiento sobre las ID de confianza en donde Aodh es la entidad de confianza obtener un token Keystone y realizar acciones autenticadas no especificadas añadiendo una acción de alarma con el esquema "trust+http" y proporcionando una ID de confianza en donde Aodh es la entidad de confianza. • http://www.debian.org/security/2017/dsa-3953 http://www.securityfocus.com/bid/100455 https://access.redhat.com/errata/RHSA-2017:3227 https://access.redhat.com/errata/RHSA-2018:0315 https://bugs.launchpad.net/ossn/+bug/1649333 https://review.openstack.org/#/c/493823 https://review.openstack.org/#/c/493824 https://review.openstack.org/#/c/493826 https://access.redhat.com/security/cve/CVE-2017-12440 https://bugzilla.redhat.com/show_bug.cgi?id=1478834 • CWE-306: Missing Authentication for Critical Function CWE-345: Insufficient Verification of Data Authenticity •