RHSA-2018:0315
Vulnerability from csaf_redhat
Published
2018-02-13 19:22
Modified
2025-10-09 17:01
Summary
Red Hat Security Advisory: openstack-aodh security update

Notes

Topic
An update for openstack-aodh is now available for Red Hat OpenStack Platform 11.0 (Ocata). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
openstack-aodh provides the ability to trigger actions based on defined rules against metric or event data collected by OpenStack Telemetry (ceilometer) or Time-Series-Database-as-a-Service (gnocchi). openstack-aodh has been rebased to the upstream 4.0.2-3 version. Security Fix(es): * A verification flaw was found in openstack-aodh. As part of an HTTP alarm action, a user could pass in a trust ID. However, the trust could be from anyone because it was not verified. Because the trust was then used by openstack-aodh to obtain a keystone token for the alarm action, a malicious user could pass in another person's trust ID and obtain a keystone token containing the delegated authority of that user. (CVE-2017-12440) Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Zane Bitter (Red Hat) as the original reporter.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for openstack-aodh is now available for Red Hat OpenStack Platform 11.0 (Ocata).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "openstack-aodh provides the ability to trigger actions based on defined rules against metric or event data collected by OpenStack Telemetry (ceilometer) or Time-Series-Database-as-a-Service (gnocchi).\n\nopenstack-aodh has been rebased to the upstream 4.0.2-3 version.\n\nSecurity Fix(es):\n\n* A verification flaw was found in openstack-aodh. As part of an HTTP alarm action, a user could pass in a trust ID. However, the trust could be from anyone because it was not verified. Because the trust was then used by openstack-aodh to obtain a keystone token for the alarm action, a malicious user could pass in another person\u0027s trust ID and obtain a keystone token containing the delegated authority of that user. (CVE-2017-12440)\n\nRed Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Zane Bitter (Red Hat) as the original reporter.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2018:0315",
        "url": "https://access.redhat.com/errata/RHSA-2018:0315"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1478834",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1478834"
      },
      {
        "category": "external",
        "summary": "1511108",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1511108"
      },
      {
        "category": "external",
        "summary": "1531873",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1531873"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0315.json"
      }
    ],
    "title": "Red Hat Security Advisory: openstack-aodh security update",
    "tracking": {
      "current_release_date": "2025-10-09T17:01:46+00:00",
      "generator": {
        "date": "2025-10-09T17:01:46+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.9"
        }
      },
      "id": "RHSA-2018:0315",
      "initial_release_date": "2018-02-13T19:22:45+00:00",
      "revision_history": [
        {
          "date": "2018-02-13T19:22:45+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2018-02-13T19:22:45+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-10-09T17:01:46+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 11.0",
                "product": {
                  "name": "Red Hat OpenStack Platform 11.0",
                  "product_id": "7Server-RH7-RHOS-11.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:11::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-aodh-notifier-0:4.0.2-3.el7ost.noarch",
                "product": {
                  "name": "openstack-aodh-notifier-0:4.0.2-3.el7ost.noarch",
                  "product_id": "openstack-aodh-notifier-0:4.0.2-3.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-aodh-notifier@4.0.2-3.el7ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python-aodh-tests-0:4.0.2-3.el7ost.noarch",
                "product": {
                  "name": "python-aodh-tests-0:4.0.2-3.el7ost.noarch",
                  "product_id": "python-aodh-tests-0:4.0.2-3.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-aodh-tests@4.0.2-3.el7ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-aodh-api-0:4.0.2-3.el7ost.noarch",
                "product": {
                  "name": "openstack-aodh-api-0:4.0.2-3.el7ost.noarch",
                  "product_id": "openstack-aodh-api-0:4.0.2-3.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-aodh-api@4.0.2-3.el7ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-aodh-common-0:4.0.2-3.el7ost.noarch",
                "product": {
                  "name": "openstack-aodh-common-0:4.0.2-3.el7ost.noarch",
                  "product_id": "openstack-aodh-common-0:4.0.2-3.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-aodh-common@4.0.2-3.el7ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-aodh-compat-0:4.0.2-3.el7ost.noarch",
                "product": {
                  "name": "openstack-aodh-compat-0:4.0.2-3.el7ost.noarch",
                  "product_id": "openstack-aodh-compat-0:4.0.2-3.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-aodh-compat@4.0.2-3.el7ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-aodh-evaluator-0:4.0.2-3.el7ost.noarch",
                "product": {
                  "name": "openstack-aodh-evaluator-0:4.0.2-3.el7ost.noarch",
                  "product_id": "openstack-aodh-evaluator-0:4.0.2-3.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-aodh-evaluator@4.0.2-3.el7ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python-aodh-0:4.0.2-3.el7ost.noarch",
                "product": {
                  "name": "python-aodh-0:4.0.2-3.el7ost.noarch",
                  "product_id": "python-aodh-0:4.0.2-3.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-aodh@4.0.2-3.el7ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-aodh-listener-0:4.0.2-3.el7ost.noarch",
                "product": {
                  "name": "openstack-aodh-listener-0:4.0.2-3.el7ost.noarch",
                  "product_id": "openstack-aodh-listener-0:4.0.2-3.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-aodh-listener@4.0.2-3.el7ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-aodh-expirer-0:4.0.2-3.el7ost.noarch",
                "product": {
                  "name": "openstack-aodh-expirer-0:4.0.2-3.el7ost.noarch",
                  "product_id": "openstack-aodh-expirer-0:4.0.2-3.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-aodh-expirer@4.0.2-3.el7ost?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-aodh-0:4.0.2-3.el7ost.src",
                "product": {
                  "name": "openstack-aodh-0:4.0.2-3.el7ost.src",
                  "product_id": "openstack-aodh-0:4.0.2-3.el7ost.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-aodh@4.0.2-3.el7ost?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-aodh-0:4.0.2-3.el7ost.src as a component of Red Hat OpenStack Platform 11.0",
          "product_id": "7Server-RH7-RHOS-11.0:openstack-aodh-0:4.0.2-3.el7ost.src"
        },
        "product_reference": "openstack-aodh-0:4.0.2-3.el7ost.src",
        "relates_to_product_reference": "7Server-RH7-RHOS-11.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-aodh-api-0:4.0.2-3.el7ost.noarch as a component of Red Hat OpenStack Platform 11.0",
          "product_id": "7Server-RH7-RHOS-11.0:openstack-aodh-api-0:4.0.2-3.el7ost.noarch"
        },
        "product_reference": "openstack-aodh-api-0:4.0.2-3.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-11.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-aodh-common-0:4.0.2-3.el7ost.noarch as a component of Red Hat OpenStack Platform 11.0",
          "product_id": "7Server-RH7-RHOS-11.0:openstack-aodh-common-0:4.0.2-3.el7ost.noarch"
        },
        "product_reference": "openstack-aodh-common-0:4.0.2-3.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-11.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-aodh-compat-0:4.0.2-3.el7ost.noarch as a component of Red Hat OpenStack Platform 11.0",
          "product_id": "7Server-RH7-RHOS-11.0:openstack-aodh-compat-0:4.0.2-3.el7ost.noarch"
        },
        "product_reference": "openstack-aodh-compat-0:4.0.2-3.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-11.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-aodh-evaluator-0:4.0.2-3.el7ost.noarch as a component of Red Hat OpenStack Platform 11.0",
          "product_id": "7Server-RH7-RHOS-11.0:openstack-aodh-evaluator-0:4.0.2-3.el7ost.noarch"
        },
        "product_reference": "openstack-aodh-evaluator-0:4.0.2-3.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-11.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-aodh-expirer-0:4.0.2-3.el7ost.noarch as a component of Red Hat OpenStack Platform 11.0",
          "product_id": "7Server-RH7-RHOS-11.0:openstack-aodh-expirer-0:4.0.2-3.el7ost.noarch"
        },
        "product_reference": "openstack-aodh-expirer-0:4.0.2-3.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-11.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-aodh-listener-0:4.0.2-3.el7ost.noarch as a component of Red Hat OpenStack Platform 11.0",
          "product_id": "7Server-RH7-RHOS-11.0:openstack-aodh-listener-0:4.0.2-3.el7ost.noarch"
        },
        "product_reference": "openstack-aodh-listener-0:4.0.2-3.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-11.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-aodh-notifier-0:4.0.2-3.el7ost.noarch as a component of Red Hat OpenStack Platform 11.0",
          "product_id": "7Server-RH7-RHOS-11.0:openstack-aodh-notifier-0:4.0.2-3.el7ost.noarch"
        },
        "product_reference": "openstack-aodh-notifier-0:4.0.2-3.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-11.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-aodh-0:4.0.2-3.el7ost.noarch as a component of Red Hat OpenStack Platform 11.0",
          "product_id": "7Server-RH7-RHOS-11.0:python-aodh-0:4.0.2-3.el7ost.noarch"
        },
        "product_reference": "python-aodh-0:4.0.2-3.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-11.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-aodh-tests-0:4.0.2-3.el7ost.noarch as a component of Red Hat OpenStack Platform 11.0",
          "product_id": "7Server-RH7-RHOS-11.0:python-aodh-tests-0:4.0.2-3.el7ost.noarch"
        },
        "product_reference": "python-aodh-tests-0:4.0.2-3.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-11.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "the OpenStack project"
          ]
        },
        {
          "names": [
            "Zane Bitter"
          ],
          "organization": "Red Hat",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2017-12440",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "discovery_date": "2017-08-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1478834"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openstack-aodh: Aodh can be used to launder Keystone trusts",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOS-11.0:openstack-aodh-0:4.0.2-3.el7ost.src",
          "7Server-RH7-RHOS-11.0:openstack-aodh-api-0:4.0.2-3.el7ost.noarch",
          "7Server-RH7-RHOS-11.0:openstack-aodh-common-0:4.0.2-3.el7ost.noarch",
          "7Server-RH7-RHOS-11.0:openstack-aodh-compat-0:4.0.2-3.el7ost.noarch",
          "7Server-RH7-RHOS-11.0:openstack-aodh-evaluator-0:4.0.2-3.el7ost.noarch",
          "7Server-RH7-RHOS-11.0:openstack-aodh-expirer-0:4.0.2-3.el7ost.noarch",
          "7Server-RH7-RHOS-11.0:openstack-aodh-listener-0:4.0.2-3.el7ost.noarch",
          "7Server-RH7-RHOS-11.0:openstack-aodh-notifier-0:4.0.2-3.el7ost.noarch",
          "7Server-RH7-RHOS-11.0:python-aodh-0:4.0.2-3.el7ost.noarch",
          "7Server-RH7-RHOS-11.0:python-aodh-tests-0:4.0.2-3.el7ost.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2017-12440"
        },
        {
          "category": "external",
          "summary": "RHBZ#1478834",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1478834"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2017-12440",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-12440"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-12440",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12440"
        },
        {
          "category": "external",
          "summary": "https://wiki.openstack.org/wiki/OSSN/OSSN-0080",
          "url": "https://wiki.openstack.org/wiki/OSSN/OSSN-0080"
        }
      ],
      "release_date": "2017-08-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2018-02-13T19:22:45+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOS-11.0:openstack-aodh-0:4.0.2-3.el7ost.src",
            "7Server-RH7-RHOS-11.0:openstack-aodh-api-0:4.0.2-3.el7ost.noarch",
            "7Server-RH7-RHOS-11.0:openstack-aodh-common-0:4.0.2-3.el7ost.noarch",
            "7Server-RH7-RHOS-11.0:openstack-aodh-compat-0:4.0.2-3.el7ost.noarch",
            "7Server-RH7-RHOS-11.0:openstack-aodh-evaluator-0:4.0.2-3.el7ost.noarch",
            "7Server-RH7-RHOS-11.0:openstack-aodh-expirer-0:4.0.2-3.el7ost.noarch",
            "7Server-RH7-RHOS-11.0:openstack-aodh-listener-0:4.0.2-3.el7ost.noarch",
            "7Server-RH7-RHOS-11.0:openstack-aodh-notifier-0:4.0.2-3.el7ost.noarch",
            "7Server-RH7-RHOS-11.0:python-aodh-0:4.0.2-3.el7ost.noarch",
            "7Server-RH7-RHOS-11.0:python-aodh-tests-0:4.0.2-3.el7ost.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2018:0315"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOS-11.0:openstack-aodh-0:4.0.2-3.el7ost.src",
            "7Server-RH7-RHOS-11.0:openstack-aodh-api-0:4.0.2-3.el7ost.noarch",
            "7Server-RH7-RHOS-11.0:openstack-aodh-common-0:4.0.2-3.el7ost.noarch",
            "7Server-RH7-RHOS-11.0:openstack-aodh-compat-0:4.0.2-3.el7ost.noarch",
            "7Server-RH7-RHOS-11.0:openstack-aodh-evaluator-0:4.0.2-3.el7ost.noarch",
            "7Server-RH7-RHOS-11.0:openstack-aodh-expirer-0:4.0.2-3.el7ost.noarch",
            "7Server-RH7-RHOS-11.0:openstack-aodh-listener-0:4.0.2-3.el7ost.noarch",
            "7Server-RH7-RHOS-11.0:openstack-aodh-notifier-0:4.0.2-3.el7ost.noarch",
            "7Server-RH7-RHOS-11.0:python-aodh-0:4.0.2-3.el7ost.noarch",
            "7Server-RH7-RHOS-11.0:python-aodh-tests-0:4.0.2-3.el7ost.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openstack-aodh: Aodh can be used to launder Keystone trusts"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.