Bug 961741 (CVE-2015-5295) - VUL-0: CVE-2015-5295: openstack-heat: denial of service through template-validate
Summary: VUL-0: CVE-2015-5295: openstack-heat: denial of service through template-vali...
Status: RESOLVED FIXED
Alias: CVE-2015-5295
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Cloud Bugs
QA Contact: Security Team bot
URL:
Whiteboard: CVSSv2:SUSE:CVE-2015-5295:4.0:(AV:N/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2016-01-13 16:30 UTC by Johannes Segitz
Modified: 2017-08-15 12:03 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---
vuntz: needinfo? (bwiedemann)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2016-01-13 16:30:00 UTC 
Created attachment 661644 [details]
Patches

Title: Heat denial of service through template-validate
Reporter: Steven Hardy (Red Hat)
Products: Heat
Affects: <=2015.1.2, ==5.0.0

Description:
Steven Hardy from Red Hat reported a vulnerability in Heat template
validation. By referencing a local file like /dev/zero, an authenticated
user may trick the heat engine service to load arbitrary local file
content resulting in a Denial of Service attack through memory
exhaustion. Note that the file content is not written back to the user,
though the user can determine if a file exists and if it is readable by
heat-engine. All Heat setups are affected.

Proposed patch:
See attached patches. Unless a flaw is discovered in them, these patches
will be merged to master, stable/liberty and stable/kilo on the public
disclosure date.

CVE: CVE-2015-5295

CRD: 2016-01-19 1500 UTC
Comment 1 Swamp Workflow Management 2016-01-13 23:00:46 UTC 
bugbot adjusting priority
Comment 2 Johannes Segitz 2016-01-20 14:21:30 UTC 
public
Comment 3 Bernhard Wiedemann 2016-01-25 13:41:44 UTC 
upstream bug is tracked at
https://bugs.launchpad.net/heat/+bug/1496277

and fixes are at
https://review.openstack.org/#/q/I845e7d23c73242a4a4c9c40599690ab705c75caa

"Load template files only from their known source"

I added bnc+CVE refs to our Liberty and Kilo packages.
Comment 5 Vincent Untz 2016-05-31 15:23:54 UTC 
Bernhard: what about Cloud 5 / Juno?
Comment 6 Johannes Segitz 2017-08-15 12:03:55 UTC 
fixed in current cloud products