Project

General

Profile

Bug #22546

CVE-2018-1097: curl api to change power state on ovirt compute_resource exposes credentials

Added by Steve D about 5 years ago. Updated over 3 years ago.


Description

Looks like the same issue as https://bugzilla.redhat.com/show_bug.cgi?id=1211613 so perhaps this is a regression.

curl -X PUT -H "Content-Type:application/json" -H "Accept:application/json" -k -u user:password -d '{"power_action": "on"}' https://foreman/api/v2/hosts/testhost.domain.name/power

{"power":{"raw":{"name":"testhost.domain.name","href":"/ovirt-engine/api/v3/vms/b67a994d-68f5-4cba-a515-c79536ce55fe","id":"b67a994d-68f5-4cba-a515-c79536ce55fe","client":{"api_entrypoint":"https://ovirt.domain.name/ovirt-engine/api/v3","credentials":{"username":"admin@internal","password":"unmaskedpassword"},
...


Related issues

Related to Foreman - Bug #23212: Changing power state gives: NameError: uninitialized constant Fog::Compute::OvirtClosed2018-04-11

Associated revisions

Revision 6fb097f9 (diff)
Added by Ori Rabin almost 5 years ago

Fixes #22546 - CVE-2018-1097: Bump fog-ovirt for power action fix

Revision 957a3a3d (diff)
Added by Michael Moll almost 5 years ago

Refs #22546 - Reflect fog-ovirt requirements update

Revision 0143a963 (diff)
Added by Michael Moll almost 5 years ago

Refs #22546 - ovirt-engine-sdk needs libcurl-dev

Revision a50d6604 (diff)
Added by Michael Moll almost 5 years ago

Refs #22546 - ovirt-engine-sdk needs libxml2-dev

Revision 241c4e4e (diff)
Added by Michael Moll almost 5 years ago

Refs #22546 - fog requires fog-ovirt. add needed deps

History

#1 Updated by Anonymous about 5 years ago

  • Difficulty deleted (easy)
  • Category changed from API to Compute resources - oVirt

#2 Updated by Tomer Brisker almost 5 years ago

  • Category changed from Compute resources - oVirt to Security

#3 Updated by The Foreman Bot almost 5 years ago

  • Assignee set to Ori Rabin
  • Status changed from New to Ready For Testing
  • Pull request https://github.com/theforeman/foreman/pull/5369 added

#4 Updated by Tomer Brisker almost 5 years ago

  • Subject changed from curl api to change power state on ovirt compute_resource exposes credentials to CVE-2018-1097: curl api to change power state on ovirt compute_resource exposes credentials

#5 Updated by The Foreman Bot almost 5 years ago

  • Pull request https://github.com/theforeman/foreman/pull/5373 added

#6 Updated by The Foreman Bot almost 5 years ago

  • Pull request https://github.com/theforeman/foreman/pull/5374 added

#7 Updated by The Foreman Bot almost 5 years ago

  • Pull request https://github.com/theforeman/foreman/pull/5375 added

#8 Updated by The Foreman Bot almost 5 years ago

  • Pull request https://github.com/theforeman/foreman/pull/5383 added

#9 Updated by Tomer Brisker almost 5 years ago

  • Legacy Backlogs Release (now unused) set to 332

#10 Updated by Ori Rabin almost 5 years ago

  • % Done changed from 0 to 100
  • Status changed from Ready For Testing to Closed

#11 Updated by The Foreman Bot almost 5 years ago

  • Pull request https://github.com/theforeman/foreman-packaging/pull/2331 added

#12 Updated by Anonymous almost 5 years ago

  • Related to Bug #23212: Changing power state gives: NameError: uninitialized constant Fog::Compute::Ovirt added

#13 Updated by The Foreman Bot almost 5 years ago

  • Pull request https://github.com/theforeman/foreman/pull/5371 added

#14 Updated by The Foreman Bot over 3 years ago

  • Pull request https://github.com/theforeman/foreman-packaging/pull/4320 added

Also available in: Atom PDF