<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p> </p>
<div class="moz-text-html" lang="x-unicode">
<pre style="color: rgb(0, 0, 0); font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-style: initial; text-decoration-color: initial; overflow-wrap: break-word; white-space: pre-wrap;">=====================================================================
OSSA-2019-005: Octavia Amphora-Agent not requiring Client-Certificate
=====================================================================
:Date: October 07, 2019
:CVE: CVE-2019-17134
Affects
~~~~~~~
- Octavia: >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0
Description
~~~~~~~~~~~
Daniel Preussker reported a vulnerability in amphora-agent, running
within Octavia Amphora Instances which allows unauthenticated access
from the management network. This leads to information disclosure and
also allows changes to the configuration of the Amphora via simple
HTTP requests because cmd/agent.py gunicorn cert_reqs option is
incorrectly set to True instead of ssl.CERT_REQUIRED.
Patches
~~~~~~~
- <a class="moz-txt-link-freetext" href="https://review.opendev.org/686547">https://review.opendev.org/686547</a> (Ocata)
- <a class="moz-txt-link-freetext" href="https://review.opendev.org/686546">https://review.opendev.org/686546</a> (Pike)
- <a class="moz-txt-link-freetext" href="https://review.opendev.org/686545">https://review.opendev.org/686545</a> (Queens)
- <a class="moz-txt-link-freetext" href="https://review.opendev.org/686544">https://review.opendev.org/686544</a> (Rocky)
- <a class="moz-txt-link-freetext" href="https://review.opendev.org/686543">https://review.opendev.org/686543</a> (Stein)
- <a class="moz-txt-link-freetext" href="https://review.opendev.org/686541">https://review.opendev.org/686541</a> (Train)
Credits
~~~~~~~
- Daniel Preussker (CVE-2019-17134)
References
~~~~~~~~~~
- <a class="moz-txt-link-freetext" href="https://storyboard.openstack.org/#!/story/2006660">https://storyboard.openstack.org/#!/story/2006660</a>
- <a class="moz-txt-link-freetext" href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17134">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17134</a>
Notes
~~~~~
- The stable/ocata and stable/pike branches are under extended maintenance and
will receive no new point releases, but patches for them are provided as a
courtesy.</pre>
</div>
</body>
</html>