Open Stack

An example of an inferred value would be the case where we have
something like the following:

value_from_api = "40MB"
trans_val = value_from_api[-2:]

In this case, the trans_val is being inferred or calculated from the
last two characters of user controlled input.  I'm not saying this is
the case, it's just an example.

-- 
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1367022

Title:
  Un-sanitized eval may have security impact

Status in OpenStack Telemetry (Ceilometer):
  New
Status in OpenStack Security Advisories:
  Won't Fix

Bug description:
  On this line:
  https://github.com/openstack/ceilometer/blob/master/ceilometer/transformer/conversions.py#L62
  eval is used for some transformation.  The comments near by suggest
  that it is used for a 'multiplicative factor or else a string to be
  eval'd'.

  If an attacker is able to provide an input like
  "__import__('os').system('rm -rf /etc')" the process will delete the
  etc directory with the privileges of the user that is running
  Ceilometer.

  Eval input should always be sanitized.  I was unable to find any
  places that this is actually used, but this should definitely be
  hardened.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ceilometer/+bug/1367022/+subscriptions