CVE-2017-12440: High severity openstack vulnerability
Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.
Other sources
When adding an alarm action with the scheme trust+http: Aodh does not verify that the user creating the alarm is the trustor or has the same rights as the trustor, not that the trust is for the same project as the alarm.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12440?
CVE-2017-12440 is considered a moderate severity vulnerability due to its impact on user trust ID verification.
How do I fix CVE-2017-12440?
To fix CVE-2017-12440, upgrade to Aodh version 6.0.1 or later.
Who is affected by CVE-2017-12440?
Users of Openstack Ocata and Newton before a certain change ID and Pike-rc1 are affected by CVE-2017-12440.
What does CVE-2017-12440 exploit?
CVE-2017-12440 exploits the lack of verification of trust IDs for remote authenticated users when creating alarm actions.
Is there a workaround for CVE-2017-12440?
No official workaround exists for CVE-2017-12440; the recommended action is to apply the available updates.