[Openstack-security] [Bug 1379077] Re: Tenants can be created with invalid ids
Jeremy Stanley
fungi at yuggoth.org
Fri Oct 24 14:17:32 UTC 2014
** Information type changed from Private Security to Public
** Tags added: security
** Changed in: ossa
Status: Confirmed => Won't Fix
--
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1379077
Title:
Tenants can be created with invalid ids
Status in OpenStack Identity (Keystone):
In Progress
Status in Keystone icehouse series:
In Progress
Status in Keystone juno series:
Confirmed
Status in OpenStack Security Advisories:
Won't Fix
Bug description:
When creating a new tenant, there is an optional argument 'id' that
may be passed:
https://github.com/openstack/keystone/blob/9025b64a8f2bf5cf01a18453d6728e081bd2c3b9/keystone/assignment/controllers.py#L114
If not passed, this just creates a uuid and proceeds. If a value is
passed, it will use that value. So a user with priv's to create a
tenant can pass something like "../../../../../" as the id. If this
is done, then the project can't be deleted without manually removing
the value from the database. This can lead to a DoS that could fill
the db and take down the cloud, in the worst of circumstances.
I believe the proper fix here would be to just remove this feature
altogether. But this is because I'm not clear about why we would ever
want to allow someone to set the id manually. If there's a valid use
case here, then we should at least do some input validation.
To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1379077/+subscriptions
More information about the Openstack-security
mailing list