keystone: CVE-2013-2014 DoS via large POST requests

Debian Bug report logs - #708515
keystone: CVE-2013-2014 DoS via large POST requests

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: submit@bugs.debian.org

Subject: keystone: CVE-2013-2014 DoS via large POST requests

Date: Thu, 16 May 2013 11:22:56 +0200

[Message part 1 (text/plain, inline)]

Package: keystone
Severity: grave
Tags: security patch

Hi,
the following vulnerability was published for keystone.

CVE-2013-2014[0]:
| Concurrent requests with large POST body can crash the keystone process.
| This can be used by Malicious and lead to DOS to Cloud Service Provider.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

Upstream patch: https://review.openstack.org/#/c/22661/

Seems to be fixed for experimental in 2013.1-1.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2014
    http://security-tracker.debian.org/tracker/CVE-2013-2014

-- 
Nico Golde - XMPP: nion@jabber.ccc.de - GPG: 0xA0A0AAAA

[Message part 2 (application/pgp-signature, inline)]

Message #10 received at 708515@bugs.debian.org (full text, mbox, reply):

From: Thomas Goirand <thomas@goirand.fr>

To: Nico Golde <nion@debian.org>, 708515@bugs.debian.org

Subject: Re: [Openstack-devel] Bug#708515: keystone: CVE-2013-2014 DoS via large POST requests

Date: Thu, 16 May 2013 19:24:25 +0800

On 05/16/2013 05:22 PM, Nico Golde wrote:
> Package: keystone
> Severity: grave
> Tags: security patch
> 
> Hi,
> the following vulnerability was published for keystone.
> 
> CVE-2013-2014[0]:
> | Concurrent requests with large POST body can crash the keystone process.
> | This can be used by Malicious and lead to DOS to Cloud Service Provider.
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> Upstream patch: https://review.openstack.org/#/c/22661/
> 
> Seems to be fixed for experimental in 2013.1-1.
> 
> For further information see:
> 
> [0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2014
>     http://security-tracker.debian.org/tracker/CVE-2013-2014

Hi,

The status of the patch you are linking to is "Abandoned", so that
doesn't seem right, upstream must have another patch.

Thomas

Message #15 received at 708515@bugs.debian.org (full text, mbox, reply):

From: Thomas Goirand <thomas@goirand.fr>

To: Nico Golde <nion@debian.org>, 708515@bugs.debian.org

Subject: Re: [Openstack-devel] Bug#708515: keystone: CVE-2013-2014 DoS via large POST requests

Date: Thu, 16 May 2013 19:50:15 +0800

[Message part 1 (text/plain, inline)]

On 05/16/2013 05:22 PM, Nico Golde wrote:
> Package: keystone
> Severity: grave
> Tags: security patch
> 
> Hi,
> the following vulnerability was published for keystone.
> 
> CVE-2013-2014[0]:
> | Concurrent requests with large POST body can crash the keystone process.
> | This can be used by Malicious and lead to DOS to Cloud Service Provider.
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> Upstream patch: https://review.openstack.org/#/c/22661/
> 
> Seems to be fixed for experimental in 2013.1-1.
> 
> For further information see:
> 
> [0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2014
>     http://security-tracker.debian.org/tracker/CVE-2013-2014

FYI, the patch for Grizzly is there:
https://review.openstack.org/#/c/19567/

Though I don't think it will be trivial to backport. I have attached the
corresponding git commit from the Grizzly (eg: 2013.1.x) branch.

Indeed, 2013.1.1 isn't vulnerable (I could see the patch in the git
log). I have uploaded earlier today that version to Sid (and that was
unrelated to this issue, I was just working on it).

Cheers,

Thomas

[limit-the-size-of-http-requests.patch (text/x-diff, attachment)]

Message #22 received at 708515@bugs.debian.org (full text, mbox, reply):

From: Thomas Goirand <zigo@debian.org>

To: Thierry Carrez <thierry@openstack.org>, 708515@bugs.debian.org

Subject: Bug #708515 in Debian

Date: Sat, 01 Jun 2013 15:36:24 +0800

Hi Thierry,

I was wondering if you could help me here. I'm worried about this new
bug in Debian:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=708515

I tried applying the patch, though it was already applied in the Sid
version of keystone.

But also, there is this issue which I already addressed:
bugs.debian.org/cgi-bin/bugreport.cgi?bug=700240

Already CVE-2013-0247 and CVE-2013-0270 were duplicates. Is it possible
that CVE-2013-2014 is also a duplicate of the same issue?

Please let me know your thoughts, as I really would like to close this
bug. Thanks in advance,

Thomas Goirand (zigo)

Message #27 received at 708515@bugs.debian.org (full text, mbox, reply):

From: Thierry Carrez <thierry@openstack.org>

To: Thomas Goirand <zigo@debian.org>

Cc: 708515@bugs.debian.org

Subject: Re: Bug #708515 in Debian

Date: Mon, 03 Jun 2013 11:01:40 +0200

Thomas Goirand wrote:
> I was wondering if you could help me here. I'm worried about this new
> bug in Debian:
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=708515

The CVE and bug are lacking a bit of information, but it really looks
like a duplicate of Debian bug 700240 (CVE-2013-0270): large POST
requests consuming server memory/CPU. Both would be mitigated by a
request-limiting front-end (for Folsom and before) or the sizelimit
middleware (for Grizzly and after), which were suggested as workarounds
for CVE-2013-0270 already.

> Already CVE-2013-0247 and CVE-2013-0270 were duplicates. Is it possible
> that CVE-2013-2014 is also a duplicate of the same issue?

CVE-2013-0247 is not a duplicate of CVE-2013-0270.

CVE-2013-0270: Large POST consuming memory/CPU
CVE-2013-0247: Malicious POST to /tokens consuming disk space

Hope this helps,

-- 
Thierry Carrez (ttx)
OpenStack Vulnerability Management Team

Message #32 received at 708515-done@bugs.debian.org (full text, mbox, reply):

From: Thomas Goirand <zigo@debian.org>

To: 708515-done@bugs.debian.org

Subject: Bug already fixed

Date: Tue, 04 Jun 2013 00:00:46 +0800

As per TTX email, and as I already thought, this bug has already been
fixed a long time ago, so I'm closing it.

Thomas

Send a report that this bug log contains spam.