)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"4190ed3a8f8409dc6601ae7c36858f32d4f815c8","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     hyakuhei \u003crobert.clark@hp.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2014-10-07 14:36:53 +0100"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add previously pulished OSSNs"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"A handful of previously published OSSNs were never migrated to our"},{"line_number":10,"context_line":"git repo or publishing area on the wiki.  This adds the existing"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"baa201ad_9b295a9d","line":7,"updated":"2014-10-08 10:37:14.000000000","message":"typeo: pulished","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"}],"security-notes/OSSN-0031":[{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"2bc695c15311e686f03e5f61934858ee9876d387","unresolved":false,"context_lines":[{"line_number":6,"context_line":"Baremetal."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"### Affected Services / Software ###"},{"line_number":9,"context_line":"Nova Baremetal, Icehouse, Juno, Kilo, Future Releases"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Discussion ###"},{"line_number":12,"context_line":"Nova Baremetal is intended for testing and development only, it is not"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa201ad_0c962f3f","line":9,"updated":"2014-10-07 14:52:09.000000000","message":"What about just saying \"All Releases\"?","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"f9bb234d7f355ecbe6b28a3051d966765621e5ef","unresolved":false,"context_lines":[{"line_number":6,"context_line":"Baremetal."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"### Affected Services / Software ###"},{"line_number":9,"context_line":"Nova Baremetal, Icehouse, Juno, Kilo, Future Releases"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Discussion ###"},{"line_number":12,"context_line":"Nova Baremetal is intended for testing and development only, it is not"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa201ad_60116551","line":9,"in_reply_to":"baa201ad_0c962f3f","updated":"2014-10-08 09:36:27.000000000","message":"+1","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"}],"security-notes/OSSN-0032":[{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"f9bb234d7f355ecbe6b28a3051d966765621e5ef","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Disabling a tenant does not disable a user token"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa201ad_c09e91b8","line":1,"updated":"2014-10-08 09:36:27.000000000","message":"will this have an effect on trusts? i.e. trusts issued for/by the tenant are similarly not revoked, or am i misunderstanding how they work.","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"ef3d8220099195a8dc2e23f8af02e2486e7dd878","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Disabling a tenant does not disable a user token"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa201ad_0870bb09","line":1,"in_reply_to":"baa201ad_c09e91b8","updated":"2014-10-08 14:00:39.000000000","message":"I know in more modern releases (where this issue does not exist), execucting a trust to issue a trust token checks if a trustor is valid before issuance.  I have not checked the behavior for this in Grizzly, where trusts were first implemented.\n\nI think the revocation of issued trust tokens themselves would need to be investigated.","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"f9bb234d7f355ecbe6b28a3051d966765621e5ef","unresolved":false,"context_lines":[{"line_number":12,"context_line":"### Discussion ###"},{"line_number":13,"context_line":"Keystone does not purge the tokens given out to tenants when a tenant"},{"line_number":14,"context_line":"is disabled. In some scenarios this could be very important to cloud"},{"line_number":15,"context_line":"providers. Take the case where a cloud provider must a revoke tenant\u0027s"},{"line_number":16,"context_line":"access because of some legal investigation. Even though the tenant is"},{"line_number":17,"context_line":"disabled it would be possible for them to terminate VMs / delete Swift"},{"line_number":18,"context_line":"files etc. There are many other abuse-cases."}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa201ad_603885d3","line":15,"updated":"2014-10-08 09:36:27.000000000","message":"... must revoke a ...","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"}],"security-notes/OSSN-0033":[{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"f9bb234d7f355ecbe6b28a3051d966765621e5ef","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In many places, OpenStack components use Python 2.x HTTPSConnection to"},{"line_number":6,"context_line":"establish an SSL connection between endpoints. This does not provide"},{"line_number":7,"context_line":"many of the assurances one would expect when using SSL and leaves"},{"line_number":8,"context_line":"connections open to potential man-in-the-middle attacks."}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa201ad_6094058b","line":5,"updated":"2014-10-08 09:36:27.000000000","message":"possible bandit check here? Maybe we should have Bandit refer to OSSNs that document detected issues.","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"2bc695c15311e686f03e5f61934858ee9876d387","unresolved":false,"context_lines":[{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"A secure SSL session relies on validation of a X.509 certificate. Basic"},{"line_number":15,"context_line":"checks include:"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"  - Certificate signed by recognised Certificate Authority?"},{"line_number":18,"context_line":"  - Is the certificate revoked by CRL or OCSP?"},{"line_number":19,"context_line":"  - Has the certificate expired?"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa201ad_0c51cf35","line":16,"updated":"2014-10-07 14:52:09.000000000","message":"We should make the following section either statements or questions.  They are sort of odd to read now.  It you prefer the short statement approach, let\u0027s go with something like this:\n\n- Certficate Authority trust verification\n- Certificate revocation status\n- Certificate expiration\n- Certificate subject name matching","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"f9bb234d7f355ecbe6b28a3051d966765621e5ef","unresolved":false,"context_lines":[{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"A secure SSL session relies on validation of a X.509 certificate. Basic"},{"line_number":15,"context_line":"checks include:"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"  - Certificate signed by recognised Certificate Authority?"},{"line_number":18,"context_line":"  - Is the certificate revoked by CRL or OCSP?"},{"line_number":19,"context_line":"  - Has the certificate expired?"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa201ad_a0e18d2b","line":16,"in_reply_to":"baa201ad_0c51cf35","updated":"2014-10-08 09:36:27.000000000","message":"+1","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"2bc695c15311e686f03e5f61934858ee9876d387","unresolved":false,"context_lines":[{"line_number":14,"context_line":"A secure SSL session relies on validation of a X.509 certificate. Basic"},{"line_number":15,"context_line":"checks include:"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"  - Certificate signed by recognised Certificate Authority?"},{"line_number":18,"context_line":"  - Is the certificate revoked by CRL or OCSP?"},{"line_number":19,"context_line":"  - Has the certificate expired?"},{"line_number":20,"context_line":"  - Certificate X509 common name matches URL?"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa201ad_ec2e4bfa","line":17,"updated":"2014-10-07 14:52:09.000000000","message":"s/recognised/trusted/","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"2bc695c15311e686f03e5f61934858ee9876d387","unresolved":false,"context_lines":[{"line_number":17,"context_line":"  - Certificate signed by recognised Certificate Authority?"},{"line_number":18,"context_line":"  - Is the certificate revoked by CRL or OCSP?"},{"line_number":19,"context_line":"  - Has the certificate expired?"},{"line_number":20,"context_line":"  - Certificate X509 common name matches URL?"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"The HTTPSConnection class is used in a large number of locations and"},{"line_number":23,"context_line":"fails to check that certificates are signed by a valid authority."}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa201ad_4cb3d7e8","line":20,"updated":"2014-10-07 14:52:09.000000000","message":"(nit) X.509\n\nAlso, it would be more correct to say \"..matches fully-qualified hostname\".","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"f9bb234d7f355ecbe6b28a3051d966765621e5ef","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":"The HTTPSConnection class is used in a large number of locations and"},{"line_number":23,"context_line":"fails to check that certificates are signed by a valid authority."},{"line_number":24,"context_line":"Without that check in place, the following checks (some highlighted"},{"line_number":25,"context_line":"above) are largely invalid."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"The result is that an attacker who has access to the network traffic"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa201ad_005899f8","line":24,"updated":"2014-10-08 09:36:27.000000000","message":"s/the following/subsequent/ I read \"the following\" an expect a list to follow.","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"}],"security-notes/OSSN-0034":[{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"f9bb234d7f355ecbe6b28a3051d966765621e5ef","unresolved":false,"context_lines":[{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Keystone, Memcached, Havana, Icehouse, Juno"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"There might be ways to mitigate this issue in the future, such as"},{"line_number":15,"context_line":"running Memcached on multiple machines to ensure redundancy should the"},{"line_number":16,"context_line":"Keystone server fail. In a clustered environment, it will only be an"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa201ad_a0142de9","line":13,"updated":"2014-10-08 09:36:27.000000000","message":"Please begin this section by re-introducing the issue at hand before diving into the mitigation options.","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"0d41c2b074e98e6b2e4619ee036f9d8cac4625da","unresolved":false,"context_lines":[{"line_number":14,"context_line":"The list of revoked tokens, stored in Memcached could be lost if the"},{"line_number":15,"context_line":"Memcached service is stopped or crashes before the revocation list is"},{"line_number":16,"context_line":"persisted on disk."},{"line_number":17,"context_line":" "},{"line_number":18,"context_line":"There might be ways to mitigate this issue in the future, such as"},{"line_number":19,"context_line":"running Memcached on multiple machines to ensure redundancy should the"},{"line_number":20,"context_line":"Keystone server fail. In a clustered environment, it will only be an"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"baa201ad_5bca881b","line":17,"updated":"2014-10-08 15:50:45.000000000","message":"whitespace","commit_id":"db0aa9d44e008e3bacb2b72a859a83db5dba849f"}],"security-notes/OSSN-0035":[{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"f9bb234d7f355ecbe6b28a3051d966765621e5ef","unresolved":false,"context_lines":[{"line_number":12,"context_line":"### Discussion ###"},{"line_number":13,"context_line":"HTTP Strict Transport Security (HSTS) enforces that all communications"},{"line_number":14,"context_line":"with a server go over SSL. This mitigates the threat from attacks such"},{"line_number":15,"context_line":"as SSL-Strip which replaces links on the wire, stripping away https"},{"line_number":16,"context_line":"prefixes and potentially allowing an attacker to view confidential"},{"line_number":17,"context_line":"information on the wire."},{"line_number":18,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa201ad_607a4525","line":15,"updated":"2014-10-08 09:36:27.000000000","message":"maybe add a link in the references to info about SSL-Strip attack?","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"f9bb234d7f355ecbe6b28a3051d966765621e5ef","unresolved":false,"context_lines":[{"line_number":23,"context_line":"If using Apache httpd to host Horizon, add the following to the relevant"},{"line_number":24,"context_line":"\u0027VirtualHost\u0027 entry in your Apache httpd configuration file:"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"--- begin example httpd configuration snippet ---"},{"line_number":27,"context_line":"Header add Strict-Transport-Security \"max-age\u003d15768000\""},{"line_number":28,"context_line":"--- end example httpd configuration snippet ---"},{"line_number":29,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa201ad_4098e177","line":26,"updated":"2014-10-08 09:36:27.000000000","message":"please indent this example section.","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"f9bb234d7f355ecbe6b28a3051d966765621e5ef","unresolved":false,"context_lines":[{"line_number":31,"context_line":"on a secure page. To accomplish this, add the following into your Apache"},{"line_number":32,"context_line":"httpd configuration file:"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"--- begin example httpd configuration snippet ---"},{"line_number":35,"context_line":"\u003cIfModule mod_rewrite.c\u003e"},{"line_number":36,"context_line":"  RewriteEngine On"},{"line_number":37,"context_line":"  RewriteCond %{HTTPS} off"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa201ad_809e4961","line":34,"updated":"2014-10-08 09:36:27.000000000","message":"and this one","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"f9bb234d7f355ecbe6b28a3051d966765621e5ef","unresolved":false,"context_lines":[{"line_number":42,"context_line":"If using Nginx to host Horizon, add the following to your Nginx"},{"line_number":43,"context_line":"configuration file:"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"--- begin example Nginx configuration snippet ---"},{"line_number":46,"context_line":"add_header Strict-Transport-Security max-age\u003d15768000;"},{"line_number":47,"context_line":"--- end example Nginx configuration snippet ---"},{"line_number":48,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa201ad_a0998d7a","line":45,"updated":"2014-10-08 09:36:27.000000000","message":"and this one","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"}],"security-notes/OSSN-0036":[{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"f9bb234d7f355ecbe6b28a3051d966765621e5ef","unresolved":false,"context_lines":[{"line_number":5,"context_line":"Horizon does not, by default, set the Secure Attribute in cookies."},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"### Affected Services / Software ###"},{"line_number":8,"context_line":"Horizon, Django, SSL, TLS"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Discussion ###"},{"line_number":11,"context_line":"When used in production, Horizon should have the Secure Attribute for"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa201ad_40cd4165","line":8,"updated":"2014-10-08 09:36:27.000000000","message":"worth add OpenStack releases here, or \"All Releases\"?","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"f9bb234d7f355ecbe6b28a3051d966765621e5ef","unresolved":false,"context_lines":[{"line_number":12,"context_line":"cookies set. When this flag is set, browsers will only transfer the"},{"line_number":13,"context_line":"cookie over secure channels. Without it set, browsers may transfer the"},{"line_number":14,"context_line":"cookie over plain-text channels, potentially exposing the contents to an"},{"line_number":15,"context_line":"attacker who can then use the cookie to authenticate with the Horizon"},{"line_number":16,"context_line":"server as the original user."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"### Recommended Actions ###"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa201ad_80f1e996","line":15,"updated":"2014-10-08 09:36:27.000000000","message":"Maybe add a sentence about how this exposure may occur, MITM eavesdropping etc.","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"}],"security-notes/OSSN-0037":[{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"f9bb234d7f355ecbe6b28a3051d966765621e5ef","unresolved":false,"context_lines":[{"line_number":6,"context_line":"it\u0027s default configuration."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"### Affected Services / Software ###"},{"line_number":9,"context_line":"Horizon, Django, Apache, Nginx, SSL, TLS"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Discussion ###"},{"line_number":12,"context_line":"The BREACH attack may be used to compromise Django\u0027s cross-site request"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa201ad_a0434dad","line":9,"updated":"2014-10-08 09:36:27.000000000","message":"OpenStack release versions please, or \"All releases\"","commit_id":"459dd952315c4ada20c5f66b08c8b4cef78505b3"}]}