PyCADF Notifier Middleware Information Disclosure Vulnerability

Bugtraq ID:	68149
Class:	Design Error
CVE:	CVE-2014-4615
Remote:	Yes
Local:	No
Published:	Jun 23 2014 12:00AM
Updated:	Apr 13 2015 09:27PM
Credit:	Zhi Kun Liu from IBM
Vulnerable:	Ubuntu Ubuntu Linux 14.04 LTS Redhat OpenStack 4.0 OpenStack PyCADF 0.5.0 OpenStack neutron 2014.1.1 OpenStack neutron 2014.1 OpenStack Ceilometer 2014.1.1 OpenStack Ceilometer 2014.1 OpenStack Ceilometer 2013.2.3 OpenStack Ceilometer 2013.2 IBM PowerVC Standard Edition 1.2.1.0 IBM PowerVC Standard Edition 1.2.0.2 IBM PowerVC Standard Edition 1.2.0.1 IBM PowerVC Standard Edition 1.2.0.0 IBM PowerVC Express Edition 1.2.0.2 IBM PowerVC Express Edition 1.2.0.1 IBM PowerVC Express Edition 1.2.0.0
Not Vulnerable:

PyCADF Notifier Middleware Information Disclosure Vulnerability

PyCADF is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.

PyCADF Notifier Middleware Information Disclosure Vulnerability

An attacker can exploit this issue using readily available tools.

PyCADF Notifier Middleware Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

PyCADF Notifier Middleware Information Disclosure Vulnerability

References:

• auth token is exposed in meter http.request (OpenStack)
  
• CVE request for vulnerability in OpenStack Neutron, Ceilometer and pyCADF libra (OpenStack)
  
• OpenStack Homepage (OpenStack)
  
• Important: openstack-ceilometer security and bug fix update (Red Hat)
  
• PyCADF Documentation (OpenStack)
  
• Security Bulletin: IBM PowerVC �?? User token leak to message queue in pyCADF noti (IBM)