CVE-2014-4615
Fixed in a distro release EPSS 3%
The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).
Products: redhat openstack, canonical ubuntu_linux, openstack neutron, openstack oslo, openstack pycadf, openstack telemetry_(ceilometer)
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ceilometer | 2014.1.2-1 |
| Debian 12 | neutron | 2014.1.2-1 |
| Debian 12 | python-pycadf | 0.5.1-1 |
| Debian 13 | ceilometer | 2014.1.2-1 |
| Debian 13 | neutron | 2014.1.2-1 |
| Debian 13 | python-pycadf | 0.5.1-1 |
| Debian 14 | ceilometer | 2014.1.2-1 |
| Debian 14 | neutron | 2014.1.2-1 |
| Debian 14 | python-pycadf | 0.5.1-1 |
| Red Hat openstack 4 | openstack-ceilometer | 0:2013.2.3-2.el6ost |
| Red Hat openstack 4 | openstack-ceilometer-alarm | 0:2013.2.3-2.el6ost |
| Red Hat openstack 4 | openstack-ceilometer-api | 0:2013.2.3-2.el6ost |
| Red Hat openstack 4 | openstack-ceilometer-central | 0:2013.2.3-2.el6ost |
| Red Hat openstack 4 | openstack-ceilometer-collector | 0:2013.2.3-2.el6ost |
| Red Hat openstack 4 | openstack-ceilometer-common | 0:2013.2.3-2.el6ost |
| Red Hat openstack 4 | openstack-ceilometer-compute | 0:2013.2.3-2.el6ost |
| Red Hat openstack 4 | python-ceilometer | 0:2013.2.3-2.el6ost |
| Ubuntu 14.04 LTS | ceilometer | 2014.1.2-0ubuntu1.1 |
| Ubuntu 14.04 LTS | neutron | 1:2014.1.2-0ubuntu1.1 |
| Ubuntu 14.04 LTS | python-pycadf | 0.4.1-0ubuntu1.1 |