[Openstack-security] [Bug 1372635] Re: MITM vulnerability with EMC VMAX driver
Robert Clark
1372635 at bugs.launchpad.net
Thu Oct 9 10:33:13 UTC 2014
This is how software projects get a bad reputation. I agree with
everything that Matt has said (which won't be a surprise to the VMT).
Deviation from best practice / security failures should be a blocker to
new features/drivers being accepted into the project.
--
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1372635
Title:
MITM vulnerability with EMC VMAX driver
Status in Cinder:
New
Status in OpenStack Security Advisories:
Won't Fix
Bug description:
The EMC VMAX driver in Juno appears to blindly trust whatever
certificate it gets back from the device without any validation (it
does not specify the ca_certs parameter, etc. on
WBEMConnection.__init__). This would leave it open to a MITM attack.
To manage notifications about this bug go to:
https://bugs.launchpad.net/cinder/+bug/1372635/+subscriptions
More information about the Openstack-security
mailing list