CVE-2014-4615

Published: 24 June 2014

The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).

Priority

Status

Package	Release	Status
ceilometer Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Does not exist
	saucy	Ignored (end of life)
	trusty	Released (2014.1.2-0ubuntu1)
	upstream	Released (2014.1.2)
	Patches: upstream: https://git.openstack.org/cgit/openstack/ceilometer/commit/?id=2b6454f9f4e0585949ab68a91ed405755438d76e upstream: https://git.openstack.org/cgit/openstack/ceilometer/commit/?id=264f3b0d9640edeac743f339786e0a3b22c0f6c2
neutron Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Does not exist
	saucy	Not vulnerable (1:2013.2.3-0ubuntu1.5)
	trusty	Released (1:2014.1.2-0ubuntu1)
	upstream	Released (2014.1.2)
	Patches: upstream: https://git.openstack.org/cgit/openstack/neutron/commit/?id=0324965a0c2987e5cad6276f011682dec184205f
python-pycadf Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Does not exist
	saucy	Does not exist
	trusty	Released (0.4.1-0ubuntu1.1)
	upstream	Needed
	Patches: upstream: https://git.openstack.org/cgit/openstack/pycadf/commit/?id=966d4410a1a69e0a3af678442a1a965dae80d720

References

Bugs

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›