Created attachment 597110 [details]
patch for juno

CVE-2014-3473, CVE-2014-3474 and CVE-2014-3475

This is an advance warning of a vulnerability discovered in OpenStack,
to give you, as downstream stakeholders, a chance to coordinate the
release of fixes and reduce the vulnerability window. Please treat the
following information as confidential until the proposed public
disclosure date.

Title: Multiple XSS vulnerabilities in Horizon
Reporter: Jason Hullinger (HP),
          Craig Lorentzen (Cisco),
          Michael Xin     (Rackspace)
Products: Horizon
Versions: up to 2013.2.3, and 2014.1

Description:
Jason Hullinger from Hewlett Packard, Craig Lorentzen from Cisco and
Michael Xin from Rackspace reported 3 cross-site scripting (XSS)
vulnerabilities in Horizon. A malicious Orchestration template owner or
catalog may conduct an XSS attack once a corrupted template is used in
the Orchestration/Stack section of Horizon (CVE-2014-3473). A malicious
Horizon user may store an XSS attack by creating a network with a
corrupted name (CVE-2014-3474). A malicious Horizon administrator may
store an XSS attack by creating a user with a corrupted email address
(CVE-2014-3475). Once executed in a legitimate context these attacks may
result in potential asset stealing (horizon user/admin access
credentials, VMs/Network configuration/management, tenants' confidential
information, etc.). All Horizon setups are affected.

Proposed patch:
See attached patches. Unless a flaw is discovered in them, these patches
will be merged to stable/havana, stable/icehouse and master (Juno
development branch) on the public disclosure date.

CVE: CVE-2014-3473, CVE-2014-3474 and CVE-2014-3475

Proposed public disclosure date/time:
2014-07-08, 1500UTC
Please do not make the issue public (or release public patches) before
this coordinated embargo date.

Regards,

-- 
Tristan Cacqueray
OpenStack Vulnerability Management Team