Bug 852177 (CVE-2013-6384) - VUL-0: CVE-2013-6384: openstack-ceilometer: Ceilometer DB2/MongoDB backend password leak
Summary: VUL-0: CVE-2013-6384: openstack-ceilometer: Ceilometer DB2/MongoDB backend pa...
Status: RESOLVED FIXED
Alias: CVE-2013-6384
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Minor
Target Milestone: ---
Assignee: Sascha Peilicke
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-11-25 15:47 UTC by Victor Pereira
Modified: 2016-04-27 19:55 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2013-11-25 15:47:26 UTC 
CVE-2013-6384

Eric Brown from IBM reported an information leak in Ceilometer logs. The
password for the DB2 or MongoDB backends was logged at INFO level in the
ceilometer-api logs. An attacker with access to the logs (local shell,
log aggregation system access, or accidental leak) may leverage this
vulnerability to elevate privileges and gain direct full access to the
Ceilometer backend. Only Ceilometer setups using the DB2 or MongoDB
backends are affected.


References:
http://www.openwall.com/lists/oss-security/2013/11/22/3
https://bugs.launchpad.net/ceilometer/+bug/1244476
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6384
https://bugzilla.redhat.com/show_bug.cgi?id=1033715
Comment 1 Vincent Untz 2013-11-25 15:59:53 UTC 
Low priority as ceilometer is tech preview in 2.0... But the fix looks trivial, so we should just do it.
Comment 2 Swamp Workflow Management 2013-11-26 23:00:20 UTC 
bugbot adjusting priority
Comment 3 Sascha Peilicke 2013-11-27 14:55:40 UTC 
Grizzly is not affected, ceilometer/storage/impl_mongodb.py has the following code:

  opts = self._parse_connection_url(conf.database_connection)
  LOG.info('connecting to MongoDB on %s:%s', opts['host'], opts['port'])

Where opts['username'] and opts['password'] are never logged:

  def _parse_connection_url(self, url):
      opts = {}
      result = urlparse.urlparse(url)
      ...
      if auth:
          opts['username'], opts['password'] = auth.split(':')
Comment 4 Sascha Peilicke 2013-11-27 14:57:16 UTC 
Havana fix currently in Cloud:OpenStack:Havana:Staging, will land in Devel:Cloud:3.
Comment 5 Sascha Peilicke 2013-12-06 13:39:54 UTC 
So the fix is in D:C:3:Staging meanwhile. Will be part of next Cloud release. Closing therefore.