Open Stack

This is a utility library, so whether it is user-controlled input or not
really depends on how it is being used.  I was unable to find any actual
usages of this during my review.  Maybe somebody more familiar can help
shed some light on this.

-- 
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1367022

Title:
  Un-sanitized eval may have security impact

Status in OpenStack Telemetry (Ceilometer):
  New
Status in OpenStack Security Advisories:
  Incomplete

Bug description:
  On this line:
  https://github.com/openstack/ceilometer/blob/master/ceilometer/transformer/conversions.py#L62
  eval is used for some transformation.  The comments near by suggest
  that it is used for a 'multiplicative factor or else a string to be
  eval'd'.

  If an attacker is able to provide an input like
  "__import__('os').system('rm -rf /etc')" the process will delete the
  etc directory with the privileges of the user that is running
  Ceilometer.

  Eval input should always be sanitized.  I was unable to find any
  places that this is actually used, but this should definitely be
  hardened.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ceilometer/+bug/1367022/+subscriptions