OpenStack Security Notes

OpenStack Security Notes (OSSN) advise users of security related issues that do not warrant an OpenStack Security Advisory (OSSA).

For more information on OSSNs, see OpenStack Security Notes Process.

• OSSN-0108: Multiple authentication vulnerabilities in Ceph
• OSSN-0107: Ironic Python Agent Container HardwareManager Security Misimplemented
• OSSN-0106: Ironic API ramdisk endpoints require network-level access controls
• OSSN-0105: Glance legacy Tasks import bypasses image import URI filtering
• OSSN-0104: Ironic-Python-Agent may fallback to mDNS unexpectedly
• OSSN-0103: Manila resource-lock list trusts a foreign project_id filter
• OSSN-0102: Neutron sub-resource APIs do not verify parent ownership
• OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning
• OSSN-0100: Command Injection in IPA via chroot Execution of Tenant-Controlled binaries
• OSSN-0099: Denial of Service in Ironic under reduced process stack size
• OSSN-0098: Mistral workflow execution context exposes Keystone auth token
• OSSN-0097: Horizon RC file generation does not escape special characters in project names
• OSSN-0096: oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake
• OSSN-0095: OVN security group rules created before address group support may be ineffective
• OSSN-0094: Ensuring Volume Safety with Nova and Watcher
• OSSN-0093: Unsafe Environment Handling in MuranoPL
• OSSN-0092: Using Configuration as a Short-Term Mitigation for OSSA-2023-003
• OSSN-0091: BMC emulators developed in OpenStack community do not preserve passwords on VMs
• OSSN-0090: Best practices when configuring Glance with COW backends
• OSSN-0089: Missing configuration option in Secure Live Migration guide leads to unencrypted traffic
• OSSN-0088: Some of the Glance metadef APIs likely to leak resources
• OSSN-0087: Ceph user credential leakage to consumers of OpenStack Manila
• OSSN-0086: Dell EMC ScaleIO/VxFlex OS Backend Credentials Exposure
• OSSN-0085: Cinder configuration option can leak secret key from Ceph backend
• OSSN-0084: Data retained after deletion of a ScaleIO volume
• OSSN-0083: Keystone policy rule “identity:get_identity_providers” was ignored
• OSSN-0082: Heap and Stack based buffer overflows in dnsmasq prior to version 2.78
• OSSN-0081: sha512_crypt is insufficient for password hashing
• OSSN-0080: Aodh can be used to launder Keystone trusts
• OSSN-0079: Ceph credentials included in logs using older versions of libvirt/qemu
• OSSN-0078: copy_from in Image Service API v1 allows network port scan
• OSSN-0077: Pre-auth COPY in versioned_writes can result in a successful COPY that wouldn’t have been authorized
• OSSN-0076: Glance Image service v1 and v2 api image-create vulnerability
• OSSN-0075: Deleted Glance image IDs may be reassigned
• OSSN-0074: Nova metadata service should not be used for sensitive information
• OSSN-0073: Horizon dashboard leaks internal information through cookies
• OSSN-0070: Bandit versions lower than 1.1.0 do not escape HTML in issue reports
• OSSN-0069: Host machine exposed to tenant networks via IPv6
• OSSN-0068: Repeated token revocation requests can lead to service degradation or disruption
• OSSN-0067: Barbican server discloses SQL Connection String and X-auth token
• OSSN-0066: MongoDB guest instance allows any user to connect
• OSSN-0065: Users of Glance may be able to replace active image data
• OSSN-0064: Keystone admin_token_auth use by default causes insecure operation
• OSSN-0063: Nova and Cinder key manager for Barbican misuses cached credentials
• OSSN-0062: Potential reuse of revoked Identity tokens
• OSSN-0061: Glance image signature uses an insecure hash algorithm (MD5)
• OSSN-0060: Glance configuration option can lead to privilege escalation
• OSSN-0059: Trusted VM can be powered on untrusted hosts
• OSSN-0058: Cinder LVMISCIDriver allows possible unauthenticated mounting of volumes
• OSSN-0057: DoS attack on Glance service can lead to interruption or disruption
• OSSN-0056: Cached keystone tokens may be accepted after revocation
• OSSN-0055: Service accounts may have cloud admin privileges
• OSSN-0054: Potential Denial of Service in Horizon login
• OSSN-0053: Keystone token disclosure may result in malicious trust creation
• OSSN-0052: Python-swiftclient exposes raw token values in debug logs
• OSSN-0049: Nova ironic driver logs sensitive information while operating in debug mode
• OSSN-0048: Glance method filtering does not work under certain conditions
• OSSN-0047: Keystone does not validate that identity providers match federation mappings
• OSSN-0046: Setting services to debug mode can also set Pecan to debug
• OSSN-0045: Vulnerable clients allow a TLS protocol downgrade (FREAK)
• OSSN-0044: Older versions of noVNC allow session theft
• OSSN-0043: glibc ‘GHOST’ vulnerability can allow remote code execution
• OSSN-0042: Keystone token scoping provides no security benefit
• OSSN-0039: Configuring OpenStack deployments to prevent POODLE attacks
• OSSN-0038: Suds client subject to cache poisoning by local attacker
• OSSN-0037: Configure Horizon to mitigate BREACH/CRIME attacks
• OSSN-0036: Horizon does not set Secure Attribute in cookies
• OSSN-0035: HTTP Strict Transport Security not enabled on Horizon Dashboard
• OSSN-0034: Restarting memcached loses revoked token list
• OSSN-0033: Some SSL-Enabled connections fail to perform basic certificate checks
• OSSN-0032: Disabling a tenant does not disable a user token
• OSSN-0031: Nova Baremetal is insecure for use in multi-tenant environments
• OSSN-0030: Bash ‘shellshock’ bug can lead to code injection vulnerability.
• OSSN-0029: Neutron FWaaS rules lack port restrictions when using protocol ‘any’
• OSSN-0028: Nova leaks compute host SMBIOS serial number to guests
• OSSN-0027: Neutron ARP cache poisoning vulnerability
• OSSN-0026: Unrestricted write permission to config files can allow code execution
• OSSN-0025: Possible Glance image exposure via Swift
• OSSN-0024: Sensitive data is exposed in log statements by python-keystoneclient
• OSSN-0023: Keystone logs auth tokens in URLs at the INFO log level
• OSSN-0022: Nova Networking does not enforce security group rules following a soft reboot of an instance
• OSSN-0021: Owners of compromised accounts should verify Keystone trusts
• OSSN-0020: Disassociating floating IPs does not terminate NAT connections with Neutron L3 agent
• OSSN-0019: Cinder SSH Pool will auto-accept SSH host signatures by default
• OSSN-0018: Nova Network configuration allows guest VMs to connect to host services
• OSSN-0017: Session-fixation vulnerability in Horizon when using the default signed cookie sessions
• OSSN-0016: Cinder wipe fails in an insecure manner on Grizzly
• OSSN-0015: Glance allows non-admin users to create public images
• OSSN-0014: Multiple Cinder drivers set insecure file permissions
• OSSN-0013: Some versions of Glance do not apply property protections as expected
• OSSN-0012: OpenSSL Heartbleed vulnerability can lead to OpenStack compromise
• OSSN-0011: Heat templates with invalid references allows unintended network access
• OSSN-0010: Sample Keystone v3 policy exposes privilege escalation vulnerability
• OSSN-0009: Potential token revocation abuse via group membership
• OSSN-0008: DoS style attack on noVNC server can lead to service interruption or disruption
• OSSN-0007: Live migration instructions recommend unsecured libvirt remote access
• OSSN-0006: Keystone can allow user impersonation when using REMOTE_USER for external authentication
• OSSN-0005: Glance allows sharing of images between projects without consumer project approval
• OSSN-0004: Authenticated users are able to update passwords without providing their current password
• OSSN-0003: Keystone configuration should not be world readable
• OSSN-0002: HTTP POST limiting advised to avoid Essex/Folsom Keystone DoS
• OSSN-0001: Selecting LXC as Nova Virtualization Driver can lead to data compromise