CVE-2013-6426

Related Files

Red Hat Security Advisory 2014-0090-01

Posted Jan 23, 2014

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0090-01 - The openstack-heat packages provide heat, a Python implementation of the OpenStack Orchestration engine, to launch multiple composite cloud applications based on templates. It was found that heat did not properly enforce cloudformation-compatible API policy rules. An in-instance attacker could use the CreateStack or UpdateStack methods to create or update a stack, resulting in a violation of the API policy. Note that only setups using Orchestration's cloudformation-compatible API were affected. A flaw was found in the way Orchestration's REST API implementation handled modified request paths. An authenticated remote user could use this flaw to bypass the tenant-scoping restriction by modifying the request path, resulting in privilege escalation. Note that only setups using Orchestration's cloudformation-compatible API were affected.

tags | advisory, remote, python

systems | linux, redhat

advisories | CVE-2013-6426, CVE-2013-6428

SHA-256 | 4eef99862e59c551295d7917e5c785068040a4c30d7833175e952cee56708be2

Download | Favorite | View