Bug #22546
CVE-2018-1097: curl api to change power state on ovirt compute_resource exposes credentials
Description
Looks like the same issue as https://bugzilla.redhat.com/show_bug.cgi?id=1211613 so perhaps this is a regression.
curl -X PUT -H "Content-Type:application/json" -H "Accept:application/json" -k -u user:password -d '{"power_action": "on"}' https://foreman/api/v2/hosts/testhost.domain.name/power
{"power":{"raw":{"name":"testhost.domain.name","href":"/ovirt-engine/api/v3/vms/b67a994d-68f5-4cba-a515-c79536ce55fe","id":"b67a994d-68f5-4cba-a515-c79536ce55fe","client":{"api_entrypoint":"https://ovirt.domain.name/ovirt-engine/api/v3","credentials":{"username":"admin@internal","password":"unmaskedpassword"},
...
Related issues
Associated revisions
Refs #22546 - Reflect fog-ovirt requirements update
Refs #22546 - ovirt-engine-sdk needs libcurl-dev
Refs #22546 - ovirt-engine-sdk needs libxml2-dev
Refs #22546 - fog requires fog-ovirt. add needed deps
History
#1
Updated by Anonymous about 5 years ago
- Difficulty deleted (
easy) - Category changed from API to Compute resources - oVirt
#2
Updated by Tomer Brisker almost 5 years ago
Updated by - Category changed from Compute resources - oVirt to Security
#3
Updated by The Foreman Bot almost 5 years ago
Updated by - Assignee set to Ori Rabin
- Status changed from New to Ready For Testing
- Pull request https://github.com/theforeman/foreman/pull/5369 added
#4
Updated by Tomer Brisker almost 5 years ago
- Subject changed from curl api to change power state on ovirt compute_resource exposes credentials to CVE-2018-1097: curl api to change power state on ovirt compute_resource exposes credentials
#5
Updated by The Foreman Bot almost 5 years ago
- Pull request https://github.com/theforeman/foreman/pull/5373 added
#6
Updated by The Foreman Bot almost 5 years ago
- Pull request https://github.com/theforeman/foreman/pull/5374 added
#7
Updated by The Foreman Bot almost 5 years ago
- Pull request https://github.com/theforeman/foreman/pull/5375 added
#8
Updated by The Foreman Bot almost 5 years ago
- Pull request https://github.com/theforeman/foreman/pull/5383 added
#9
Updated by Tomer Brisker almost 5 years ago
- Legacy Backlogs Release (now unused) set to 332
#10
Updated by Ori Rabin almost 5 years ago
Updated by - % Done changed from 0 to 100
- Status changed from Ready For Testing to Closed
Applied in changeset 6fb097f945d642c39747e885ec767cacd70fbc76.
#11
Updated by The Foreman Bot almost 5 years ago
- Pull request https://github.com/theforeman/foreman-packaging/pull/2331 added
#12
Updated by Anonymous almost 5 years ago
- Related to Bug #23212: Changing power state gives: NameError: uninitialized constant Fog::Compute::Ovirt added
#13
Updated by The Foreman Bot almost 5 years ago
- Pull request https://github.com/theforeman/foreman/pull/5371 added
#14
Updated by The Foreman Bot over 3 years ago
- Pull request https://github.com/theforeman/foreman-packaging/pull/4320 added
Fixes #22546 - CVE-2018-1097: Bump fog-ovirt for power action fix