Project

General

Profile

Actions
Copy link

Bug #22546

closed

CVE-2018-1097: curl api to change power state on ovirt compute_resource exposes credentials

Added by Steve D over 7 years ago. Updated over 5 years ago.

Status:
Closed
Priority:
Urgent
Assignee:
Ori Rabin
Category:
Security
Target version:
1.16.1
Difficulty:
Triaged:
Bugzilla link:
Pull request:
https://github.com/theforeman/foreman/pull/5369, https://github.com/theforeman/foreman/pull/5373, https://github.com/theforeman/foreman/pull/5374, https://github.com/theforeman/foreman/pull/5375, https://github.com/theforeman/foreman/pull/5383, https://github.com/theforeman/foreman-packaging/pull/2331, https://github.com/theforeman/foreman/pull/5371, https://github.com/theforeman/foreman-packaging/pull/4320
Fixed in Releases:
Found in Releases:
1.15.6
Red Hat JIRA:

Description

Looks like the same issue as https://bugzilla.redhat.com/show_bug.cgi?id=1211613 so perhaps this is a regression.

curl -X PUT -H "Content-Type:application/json" -H "Accept:application/json" -k -u user:password -d '{"power_action": "on"}' https://foreman/api/v2/hosts/testhost.domain.name/power

{"power":{"raw":{"name":"testhost.domain.name","href":"/ovirt-engine/api/v3/vms/b67a994d-68f5-4cba-a515-c79536ce55fe","id":"b67a994d-68f5-4cba-a515-c79536ce55fe","client":{"api_entrypoint":"https://ovirt.domain.name/ovirt-engine/api/v3","credentials":{"username":"admin@internal","password":"unmaskedpassword"},
...

Related issues 1 (0 open — 1 closed)

Related to Foreman - Bug #23212: Changing power state gives: NameError: uninitialized constant Fog::Compute::OvirtClosed04/11/2018Actions
Actions
Copy link
 #1

Updated by Anonymous over 7 years ago

  • Category changed from API to Compute resources - oVirt
  • Difficulty deleted (easy)
Actions
Copy link
 #2

Updated by Tomer Brisker about 7 years ago

  • Category changed from Compute resources - oVirt to Security
Actions
Copy link
 #3

Updated by The Foreman Bot about 7 years ago

  • Status changed from New to Ready For Testing
  • Assignee set to Ori Rabin
  • Pull request https://github.com/theforeman/foreman/pull/5369 added
Actions
Copy link
 #4

Updated by Tomer Brisker about 7 years ago

  • Subject changed from curl api to change power state on ovirt compute_resource exposes credentials to CVE-2018-1097: curl api to change power state on ovirt compute_resource exposes credentials
Actions
Copy link
 #5

Updated by The Foreman Bot about 7 years ago

  • Pull request https://github.com/theforeman/foreman/pull/5373 added
Actions
Copy link
 #6

Updated by The Foreman Bot about 7 years ago

  • Pull request https://github.com/theforeman/foreman/pull/5374 added
Actions
Copy link
 #7

Updated by The Foreman Bot about 7 years ago

  • Pull request https://github.com/theforeman/foreman/pull/5375 added
Actions
Copy link
 #8

Updated by The Foreman Bot about 7 years ago

  • Pull request https://github.com/theforeman/foreman/pull/5383 added
Actions
Copy link
 #9

Updated by Tomer Brisker about 7 years ago

  • Translation missing: en.field_release set to 332
Actions
Copy link
 #10

Updated by Ori Rabin about 7 years ago

  • Status changed from Ready For Testing to Closed
  • % Done changed from 0 to 100
Actions
Copy link
 #11

Updated by The Foreman Bot about 7 years ago

  • Pull request https://github.com/theforeman/foreman-packaging/pull/2331 added
Actions
Copy link
 #12

Updated by Anonymous about 7 years ago

  • Related to Bug #23212: Changing power state gives: NameError: uninitialized constant Fog::Compute::Ovirt added
Actions
Copy link
 #13

Updated by The Foreman Bot about 7 years ago

  • Pull request https://github.com/theforeman/foreman/pull/5371 added
Actions
Copy link
 #14

Updated by The Foreman Bot over 5 years ago

  • Pull request https://github.com/theforeman/foreman-packaging/pull/4320 added
Actions
Copy link

Also available in: Atom PDF