Vulnerability Name:

CVE-2014-4615 (CCN-93934)

Assigned:2014-06-23
Published:2014-06-23
Updated:2017-01-07
Summary:The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-200
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2014-4615

Source: REDHAT
Type: UNKNOWN
RHSA-2014:1050

Source: CCN
Type: oss-security Mailing List, Mon 23 Jun 2014
CVE request for vulnerability in OpenStack Neutron, Ceilometer and pyCADF library

Source: SECUNIA
Type: UNKNOWN
60643

Source: SECUNIA
Type: UNKNOWN
60736

Source: SECUNIA
Type: UNKNOWN
60766

Source: CCN
Type: IBM Security Bulletin 1020222
IBM PowerVC User token leak to message queue in pyCADF notifier middleware (CVE-2014-4615)

Source: MLIST
Type: UNKNOWN
[oss-security] 20140623 CVE request for vulnerability in OpenStack Neutron, Ceilometer and pyCADF library

Source: MLIST
Type: UNKNOWN
[oss-security] 20140624 Re: CVE request for vulnerability in OpenStack Neutron, Ceilometer and pyCADF library

Source: MLIST
Type: UNKNOWN
[oss-security] 20140625 [OSSA 2014-021] User token leak to message queue in pyCADF notifier middleware (CVE-2014-4615)

Source: CCN
Type: OSVDB ID: 108353
PyCADF Notifier Middleware REST Request Authentication Token Disclosure

Source: BID
Type: UNKNOWN
68149

Source: CCN
Type: BID-68149
PyCADF Notifier Middleware Information Disclosure Vulnerability

Source: UBUNTU
Type: UNKNOWN
USN-2311-1

Source: XF
Type: UNKNOWN
pycadf-cve20144615-info-disc(93934)

Source: CCN
Type: Python Web site
PyCADF

Source: CCN
Type: Openstack Web site
Neutron

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2014-4615

Vulnerable Configuration:Configuration 1:
  • cpe:/a:redhat:openstack:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

    • Configuration 2:
  • cpe:/a:openstack:neutron:2014.1:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:neutron:2014.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:neutron:juno1:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:oslo:-:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:pycadf:0.1:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:pycadf:0.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:pycadf:0.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:pycadf:0.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:pycadf:0.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:pycadf:0.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:pycadf:0.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:pycadf:0.1.7:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:pycadf:0.1.8:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:pycadf:0.1.9:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:pycadf:0.2:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:pycadf:0.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:pycadf:0.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:pycadf:0.3:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:pycadf:0.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:pycadf:0.4:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:pycadf:0.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:pycadf:*:*:*:*:*:*:*:* (Version <= 0.5.0)
  • OR cpe:/a:openstack:telemetry_(ceilometer):2013.2:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:telemetry_(ceilometer):2014.1:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:openstack:ceilometer:2013.2:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:neutron:2014.1:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:neutron:2014.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:ceilometer:2013.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:ceilometer:2013.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:ceilometer:2013.2.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:26106
    P
    		USN-2321-1 -- neutron vulnerabilities
    2014-10-27
    oval:org.mitre.oval:def:26638
    P
    		USN-2311-2 -- ceilometer vulnerability
    2014-10-27
    oval:org.mitre.oval:def:26107
    P
    		USN-2311-1 -- python-pycadf vulnerability
    2014-10-13
    oval:com.ubuntu.trusty:def:20144615000
    V
    		CVE-2014-4615 on Ubuntu 14.04 LTS (trusty) - medium.
    2014-08-19
    BACK
    redhat openstack 4.0
    canonical ubuntu linux 14.04
    openstack neutron 2014.1
    openstack neutron 2014.1.1
    openstack neutron juno1
    openstack oslo -
    openstack pycadf 0.1
    openstack pycadf 0.1.1
    openstack pycadf 0.1.2
    openstack pycadf 0.1.3
    openstack pycadf 0.1.4
    openstack pycadf 0.1.5
    openstack pycadf 0.1.6
    openstack pycadf 0.1.7
    openstack pycadf 0.1.8
    openstack pycadf 0.1.9
    openstack pycadf 0.2
    openstack pycadf 0.2.1
    openstack pycadf 0.2.2
    openstack pycadf 0.3
    openstack pycadf 0.3.1
    openstack pycadf 0.4
    openstack pycadf 0.4.1
    openstack pycadf *
    openstack telemetry (ceilometer) 2013.2
    openstack telemetry (ceilometer) 2014.1
    openstack ceilometer 2013.2
    openstack neutron 2014.1
    openstack neutron 2014.1.1
    openstack ceilometer 2013.2.1
    openstack ceilometer 2013.2.2
    openstack ceilometer 2013.2.3