)]}'
{"security-notes/OSSN-0038":[{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"e522b646d0b945764f688968776ddd3c9cb3eb4c","unresolved":false,"context_lines":[{"line_number":6,"context_line":"cache implementation stores pickled objects to a predictable path in"},{"line_number":7,"context_line":"/tmp. This can be used by a local attacker to redirect SOAP requests via"},{"line_number":8,"context_line":"symlinks or run a privilege escalation / code execution attack via a"},{"line_number":9,"context_line":"pickle exploit."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"},{"line_number":12,"context_line":"Cinder, Nova, Oslo.vmware - Grizzly, Havana, Icehouse"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"baa201ad_19013a05","line":9,"updated":"2014-10-15 13:08:15.000000000","message":"elaborate on a pickle exploit? Attacks on pickle are reasonably well documented, just describe it slightly differently.","commit_id":"3a24083af9c552233b27f4218352ad926b75d989"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"df6b8f816d60acd9dfeec3024ba62018a7d7f9f1","unresolved":false,"context_lines":[{"line_number":6,"context_line":"cache implementation stores pickled objects to a predictable path in"},{"line_number":7,"context_line":"/tmp. This can be used by a local attacker to redirect SOAP requests via"},{"line_number":8,"context_line":"symlinks or run a privilege escalation / code execution attack via a"},{"line_number":9,"context_line":"pickle exploit."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"},{"line_number":12,"context_line":"Cinder, Nova, Oslo.vmware - Grizzly, Havana, Icehouse"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"baa201ad_b4881a72","line":9,"in_reply_to":"baa201ad_19013a05","updated":"2014-10-16 08:48:18.000000000","message":"I will add some detail on pickle exploits to the discussion section and introduce it there.","commit_id":"3a24083af9c552233b27f4218352ad926b75d989"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"979cd3410f6cc1cbfd28c06989274423880b7707","unresolved":false,"context_lines":[{"line_number":8,"context_line":"symlinks or run a privilege escalation / code execution attack."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Cinder, Nova, Oslo.vmware - Grizzly, Havana, Icehouse"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"The python \u0027suds\u0027 package is used by oslo.vmware to interface with SOAP"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"9aa7fdbe_a670c940","line":11,"updated":"2014-10-28 02:30:36.000000000","message":"I don\u0027t know that we need to mention oslo.vmware in the list here, for the same reasons Tristan mentioned eliminating it from the OSSA that was being drafted:\n\n    https://bugs.launchpad.net/cinder/+bug/1341954/comments/4\n\nThat said, I\u0027m OK if you feel that it should be listed, but \u0027oslo\u0027 should be lowercase since you\u0027re using a module name here.\n\nAlso, don\u0027t use a hyphen here.  Just make this a simple comma-separated list of services followed by versions:\n\n    \"Cinder, Nova, Grizzly, Havana, Icehouse\"","commit_id":"ad9b037578962a8d3bb172365d8c692e504b181f"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"0c01f99f27b797320617b1d8ac4068acdd7aa33c","unresolved":false,"context_lines":[{"line_number":8,"context_line":"symlinks or run a privilege escalation / code execution attack."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Cinder, Nova, Oslo.vmware - Grizzly, Havana, Icehouse"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"The python \u0027suds\u0027 package is used by oslo.vmware to interface with SOAP"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"7a8c0949_7652d214","line":11,"in_reply_to":"9aa7fdbe_a670c940","updated":"2014-10-30 15:53:42.000000000","message":"done","commit_id":"ad9b037578962a8d3bb172365d8c692e504b181f"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"979cd3410f6cc1cbfd28c06989274423880b7707","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"The python \u0027suds\u0027 package is used by oslo.vmware to interface with SOAP"},{"line_number":15,"context_line":"service APIs and both Cinder and Nova have dependencies on oslo.vmware."},{"line_number":16,"context_line":"By default suds uses an on-disk cache that places pickle files,"},{"line_number":17,"context_line":"serialised Python objects, into a known location \u0027/tmp/suds\u0027. A local"},{"line_number":18,"context_line":"attacker could use symlinks or place crafted files into this location"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"9aa7fdbe_73669c2b","line":15,"updated":"2014-10-28 02:30:36.000000000","message":"Since the problem is is oslo.vmware, does that mean that this is only a problem when using the VMware drivers?  At least that\u0027s what the fix in Cinder seems to suggest:\n\nhttps://git.openstack.org/cgit/openstack/cinder/commit/?id\u003d6a41fe9c5c98a14a355fa81b41aae2c4b0ce0a7b\n\nIt\u0027s worth confirming if this issue only exists when the VMware drivers are used so we can mention that here.","commit_id":"ad9b037578962a8d3bb172365d8c692e504b181f"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"0c01f99f27b797320617b1d8ac4068acdd7aa33c","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"The python \u0027suds\u0027 package is used by oslo.vmware to interface with SOAP"},{"line_number":15,"context_line":"service APIs and both Cinder and Nova have dependencies on oslo.vmware."},{"line_number":16,"context_line":"By default suds uses an on-disk cache that places pickle files,"},{"line_number":17,"context_line":"serialised Python objects, into a known location \u0027/tmp/suds\u0027. A local"},{"line_number":18,"context_line":"attacker could use symlinks or place crafted files into this location"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"7a8c0949_d640e637","line":15,"in_reply_to":"9aa7fdbe_73669c2b","updated":"2014-10-30 15:53:42.000000000","message":"I\u0027ll look more into this, good info.","commit_id":"ad9b037578962a8d3bb172365d8c692e504b181f"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"979cd3410f6cc1cbfd28c06989274423880b7707","unresolved":false,"context_lines":[{"line_number":18,"context_line":"attacker could use symlinks or place crafted files into this location"},{"line_number":19,"context_line":"that will later be deserialised by suds."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"By manipulating the content of the cached pickle files an attacker can"},{"line_number":22,"context_line":"redirect or modifie SOAP requests. Alternatively pickle may be used to"},{"line_number":23,"context_line":"run injected Python code during the deserialisation process. This can"},{"line_number":24,"context_line":"allow the spawning of a shell to execution arbitrary OS level commands"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"9aa7fdbe_46fb9d78","line":21,"updated":"2014-10-28 02:30:36.000000000","message":"(nit) Add a comma after \u0027files\u0027.","commit_id":"ad9b037578962a8d3bb172365d8c692e504b181f"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"979cd3410f6cc1cbfd28c06989274423880b7707","unresolved":false,"context_lines":[{"line_number":19,"context_line":"that will later be deserialised by suds."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"By manipulating the content of the cached pickle files an attacker can"},{"line_number":22,"context_line":"redirect or modifie SOAP requests. Alternatively pickle may be used to"},{"line_number":23,"context_line":"run injected Python code during the deserialisation process. This can"},{"line_number":24,"context_line":"allow the spawning of a shell to execution arbitrary OS level commands"},{"line_number":25,"context_line":"with the permissions of the service using suds, thus leading to possible"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"9aa7fdbe_26ea19ac","line":22,"updated":"2014-10-28 02:30:36.000000000","message":"s/modifie/modify/\n\n(nit) Add a comma after \u0027Alternatively\u0027.","commit_id":"ad9b037578962a8d3bb172365d8c692e504b181f"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"979cd3410f6cc1cbfd28c06989274423880b7707","unresolved":false,"context_lines":[{"line_number":21,"context_line":"By manipulating the content of the cached pickle files an attacker can"},{"line_number":22,"context_line":"redirect or modifie SOAP requests. Alternatively pickle may be used to"},{"line_number":23,"context_line":"run injected Python code during the deserialisation process. This can"},{"line_number":24,"context_line":"allow the spawning of a shell to execution arbitrary OS level commands"},{"line_number":25,"context_line":"with the permissions of the service using suds, thus leading to possible"},{"line_number":26,"context_line":"privilege escalation."},{"line_number":27,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"9aa7fdbe_2638593c","line":24,"updated":"2014-10-28 02:30:36.000000000","message":"s/execution/execute/","commit_id":"ad9b037578962a8d3bb172365d8c692e504b181f"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"979cd3410f6cc1cbfd28c06989274423880b7707","unresolved":false,"context_lines":[{"line_number":26,"context_line":"privilege escalation."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"At the time of writing, the suds package appears largely unmaintained"},{"line_number":29,"context_line":"upstream. However, venders have released patched versions that do not"},{"line_number":30,"context_line":"suffer from the predictable cache path problem, Ubuntu is known to offer"},{"line_number":31,"context_line":"one such patched version."},{"line_number":32,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"9aa7fdbe_663d012b","line":29,"updated":"2014-10-28 02:30:36.000000000","message":"s/venders/vendors/","commit_id":"ad9b037578962a8d3bb172365d8c692e504b181f"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"979cd3410f6cc1cbfd28c06989274423880b7707","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"At the time of writing, the suds package appears largely unmaintained"},{"line_number":29,"context_line":"upstream. However, venders have released patched versions that do not"},{"line_number":30,"context_line":"suffer from the predictable cache path problem, Ubuntu is known to offer"},{"line_number":31,"context_line":"one such patched version."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"### Recommended Actions ###"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"9aa7fdbe_b382c4c5","line":30,"updated":"2014-10-28 02:30:36.000000000","message":"You should end the sentence at \u0027problem\u0027 and start a new sentence with \u0027Ubuntu\u0027.","commit_id":"ad9b037578962a8d3bb172365d8c692e504b181f"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"979cd3410f6cc1cbfd28c06989274423880b7707","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"### Recommended Actions ###"},{"line_number":34,"context_line":"Potential ways to fix this include explicitly setting the cache location"},{"line_number":35,"context_line":"to a directory created via tempfile.mkdtemp() or disabling cache usage"},{"line_number":36,"context_line":"in the configuration as show:"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"  \u0027client.set_options(cache\u003dNone)\u0027"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"9aa7fdbe_f36fec28","line":35,"updated":"2014-10-28 02:30:36.000000000","message":"This is recommending a source code change.  I don\u0027t think we should recommend doing this.","commit_id":"ad9b037578962a8d3bb172365d8c692e504b181f"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"0c01f99f27b797320617b1d8ac4068acdd7aa33c","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"### Recommended Actions ###"},{"line_number":34,"context_line":"Potential ways to fix this include explicitly setting the cache location"},{"line_number":35,"context_line":"to a directory created via tempfile.mkdtemp() or disabling cache usage"},{"line_number":36,"context_line":"in the configuration as show:"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"  \u0027client.set_options(cache\u003dNone)\u0027"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"7a8c0949_d6c38688","line":35,"in_reply_to":"9aa7fdbe_f36fec28","updated":"2014-10-30 15:53:42.000000000","message":"yes your right, not something to recommend in an OSSN.","commit_id":"ad9b037578962a8d3bb172365d8c692e504b181f"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"979cd3410f6cc1cbfd28c06989274423880b7707","unresolved":false,"context_lines":[{"line_number":40,"context_line":"A fix has been released to oslo.vmware that disables the use of the disk"},{"line_number":41,"context_line":"cache by default. Cinder and Nova have both bummed their requirements to"},{"line_number":42,"context_line":"include this fixed version. Deployers wishing to re-enable the cache"},{"line_number":43,"context_line":"should ascertain whether or not their vender shipped suds package is"},{"line_number":44,"context_line":"susceptible and consider the above advice."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"### Contacts / References ###"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"9aa7fdbe_7363fc41","line":43,"updated":"2014-10-28 02:30:36.000000000","message":"s/vender/vendor/","commit_id":"ad9b037578962a8d3bb172365d8c692e504b181f"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"979cd3410f6cc1cbfd28c06989274423880b7707","unresolved":false,"context_lines":[{"line_number":48,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1341954"},{"line_number":49,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":50,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":51,"context_line":"Suds: https://pypi.python.org/pypi/suds"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"9aa7fdbe_737cdcec","line":51,"updated":"2014-10-28 02:30:36.000000000","message":"You should add a reference to the associated CVE number:\n\nCVE: CVE-2013-2217","commit_id":"ad9b037578962a8d3bb172365d8c692e504b181f"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"0c01f99f27b797320617b1d8ac4068acdd7aa33c","unresolved":false,"context_lines":[{"line_number":48,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1341954"},{"line_number":49,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":50,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":51,"context_line":"Suds: https://pypi.python.org/pypi/suds"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"7a8c0949_d671c678","line":51,"in_reply_to":"9aa7fdbe_737cdcec","updated":"2014-10-30 15:53:42.000000000","message":"Done","commit_id":"ad9b037578962a8d3bb172365d8c692e504b181f"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"0184ca463f86e0590f7189c8d10d98940adae273","unresolved":false,"context_lines":[{"line_number":48,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":49,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":50,"context_line":"Suds: https://pypi.python.org/pypi/suds"},{"line_number":51,"context_line":"CVE: CVE-2013-2217"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7a8c0949_729f3460","line":51,"updated":"2014-10-31 00:09:56.000000000","message":"You need to add a newline here to pass the gate job:\n\n    security-notes/OSSN-0038:51: D005 No newline at end of file","commit_id":"5097beaa56b313c00632c2f6ce8b9e61aace91e3"},{"author":{"_account_id":12402,"name":"Robb Romans","email":"robb.romans@rackspace.com","username":"rromans"},"change_message_id":"b602950c6cf7a9f71d6c06c7a282f4cd9128b89e","unresolved":false,"context_lines":[{"line_number":37,"context_line":"  \u0027client.set_options(cache\u003dNone)\u0027"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"A fix has been released to oslo.vmware that disables the use of the disk"},{"line_number":40,"context_line":"cache by default. Cinder and Nova have both bummed their requirements to"},{"line_number":41,"context_line":"include this fixed version. Deployers wishing to re-enable the cache"},{"line_number":42,"context_line":"should ascertain whether or not their vendor shipped suds package is"},{"line_number":43,"context_line":"susceptible and consider the above advice."}],"source_content_type":"application/octet-stream","patch_set":5,"id":"7a8c0949_fa59195c","line":40,"updated":"2014-11-03 21:04:36.000000000","message":"Hi. Could you please rephrase \"both bummed their requirements to...\"","commit_id":"9d4209c9ccd46e5c56aa38dd1eaf6ba5d59631b3"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"b2830bc28f45f47e194b28082752cf0bc2224747","unresolved":false,"context_lines":[{"line_number":37,"context_line":"  \u0027client.set_options(cache\u003dNone)\u0027"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"A fix has been released to oslo.vmware that disables the use of the disk"},{"line_number":40,"context_line":"cache by default. Cinder and Nova have both bummed their requirements to"},{"line_number":41,"context_line":"include this fixed version. Deployers wishing to re-enable the cache"},{"line_number":42,"context_line":"should ascertain whether or not their vendor shipped suds package is"},{"line_number":43,"context_line":"susceptible and consider the above advice."}],"source_content_type":"application/octet-stream","patch_set":5,"id":"5a890539_513bc237","line":40,"in_reply_to":"7a8c0949_fa59195c","updated":"2014-11-13 14:21:37.000000000","message":"Done, sorry this is a typo.","commit_id":"9d4209c9ccd46e5c56aa38dd1eaf6ba5d59631b3"},{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"a160902fe5d73d1311a724667b4ac29d4fd462ec","unresolved":false,"context_lines":[{"line_number":5,"context_line":"Suds is a Python SOAP client for consuming Web Services. Its default"},{"line_number":6,"context_line":"cache implementation stores pickled objects to a predictable path in"},{"line_number":7,"context_line":"/tmp. This can be used by a local attacker to redirect SOAP requests via"},{"line_number":8,"context_line":"symlinks or run a privilege escalation / code execution attack."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Cinder, Nova, Grizzly, Havana, Icehouse"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"3a961159_ee010607","line":8,"updated":"2014-12-11 14:20:35.000000000","message":"Rather than slash (/), use or here because the slash is meaningful for a directory path above so when scanning my mind got distracted.","commit_id":"5730fa08aca3a9351b68e8bbfabb06b4b4872b31"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"d53954a2c93de4934eea3d49c916001d01d1f65f","unresolved":false,"context_lines":[{"line_number":5,"context_line":"Suds is a Python SOAP client for consuming Web Services. Its default"},{"line_number":6,"context_line":"cache implementation stores pickled objects to a predictable path in"},{"line_number":7,"context_line":"/tmp. This can be used by a local attacker to redirect SOAP requests via"},{"line_number":8,"context_line":"symlinks or run a privilege escalation / code execution attack."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Cinder, Nova, Grizzly, Havana, Icehouse"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"3a961159_2fb4e133","line":8,"in_reply_to":"3a961159_ee010607","updated":"2014-12-11 18:09:33.000000000","message":"Done","commit_id":"5730fa08aca3a9351b68e8bbfabb06b4b4872b31"},{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"a160902fe5d73d1311a724667b4ac29d4fd462ec","unresolved":false,"context_lines":[{"line_number":7,"context_line":"/tmp. This can be used by a local attacker to redirect SOAP requests via"},{"line_number":8,"context_line":"symlinks or run a privilege escalation / code execution attack."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Cinder, Nova, Grizzly, Havana, Icehouse"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"3a961159_c91b6471","line":10,"updated":"2014-12-11 14:20:35.000000000","message":"Don\u0027t use a slash in the header, makes it harder to scan and I\u0027m not sure if it means and, or or and/or. Just say and. Plus I think it could be more accurately stated as Affected Services Across Releases. If you want to be even more clear, say \"Affected Services\" for the heading then use Grizzly: Cinder, Nova; Havana: Cinder, Nova; Icehouse:Cinder, Nova as long as that is accurate.","commit_id":"5730fa08aca3a9351b68e8bbfabb06b4b4872b31"},{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"328ae9aa69b16d2cbf18b0dbb47674aa49fb5ade","unresolved":false,"context_lines":[{"line_number":7,"context_line":"/tmp. This can be used by a local attacker to redirect SOAP requests via"},{"line_number":8,"context_line":"symlinks or run a privilege escalation / code execution attack."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Cinder, Nova, Grizzly, Havana, Icehouse"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"3a961159_09e00ccc","line":10,"in_reply_to":"3a961159_c91b6471","updated":"2014-12-11 14:33:03.000000000","message":"Okay, now I see this is part of the template, and I don\u0027t like it but I realize it\u0027s pretty embedded. Rats. :) Still, I would like to indicate service:release somehow.","commit_id":"5730fa08aca3a9351b68e8bbfabb06b4b4872b31"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"8d0f4aa62d23e1c7d6ea88732ad3f291f390aa83","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Cinder, Nova, Grizzly, Havana, Icehouse"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"The python \u0027suds\u0027 package is used by oslo.vmware to interface with SOAP"},{"line_number":15,"context_line":"service APIs and both Cinder and Nova have dependencies on oslo.vmware"},{"line_number":16,"context_line":"when using VMware drivers. By default suds uses an on-disk cache that"},{"line_number":17,"context_line":"places pickle files, serialised Python objects, into a known location"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"3a961159_4ccc7436","line":14,"updated":"2014-12-07 23:19:21.000000000","message":"capitalize Python consistently.","commit_id":"5730fa08aca3a9351b68e8bbfabb06b4b4872b31"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"a7f89846d0875d03cd74578eef3d1868d402ca95","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Cinder, Nova, Grizzly, Havana, Icehouse"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"The python \u0027suds\u0027 package is used by oslo.vmware to interface with SOAP"},{"line_number":15,"context_line":"service APIs and both Cinder and Nova have dependencies on oslo.vmware"},{"line_number":16,"context_line":"when using VMware drivers. By default suds uses an on-disk cache that"},{"line_number":17,"context_line":"places pickle files, serialised Python objects, into a known location"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"3a961159_2968681c","line":14,"in_reply_to":"3a961159_4ccc7436","updated":"2014-12-11 14:37:40.000000000","message":"+1","commit_id":"5730fa08aca3a9351b68e8bbfabb06b4b4872b31"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"d53954a2c93de4934eea3d49c916001d01d1f65f","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Cinder, Nova, Grizzly, Havana, Icehouse"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"The python \u0027suds\u0027 package is used by oslo.vmware to interface with SOAP"},{"line_number":15,"context_line":"service APIs and both Cinder and Nova have dependencies on oslo.vmware"},{"line_number":16,"context_line":"when using VMware drivers. By default suds uses an on-disk cache that"},{"line_number":17,"context_line":"places pickle files, serialised Python objects, into a known location"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"3a961159_0fb7253b","line":14,"in_reply_to":"3a961159_4ccc7436","updated":"2014-12-11 18:09:33.000000000","message":"Done","commit_id":"5730fa08aca3a9351b68e8bbfabb06b4b4872b31"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"8d0f4aa62d23e1c7d6ea88732ad3f291f390aa83","unresolved":false,"context_lines":[{"line_number":28,"context_line":"At the time of writing, the suds package appears largely unmaintained"},{"line_number":29,"context_line":"upstream. However, vendors have released patched versions that do not"},{"line_number":30,"context_line":"suffer from the predictable cache path problem. Ubuntu is known to offer"},{"line_number":31,"context_line":"one such patched version."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"### Recommended Actions ###"},{"line_number":34,"context_line":"The recommended solution to this issue is to disable cache usage in the"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"3a961159_ece440ae","line":31,"updated":"2014-12-07 23:19:21.000000000","message":"what version of the package is required?","commit_id":"5730fa08aca3a9351b68e8bbfabb06b4b4872b31"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"d53954a2c93de4934eea3d49c916001d01d1f65f","unresolved":false,"context_lines":[{"line_number":28,"context_line":"At the time of writing, the suds package appears largely unmaintained"},{"line_number":29,"context_line":"upstream. However, vendors have released patched versions that do not"},{"line_number":30,"context_line":"suffer from the predictable cache path problem. Ubuntu is known to offer"},{"line_number":31,"context_line":"one such patched version."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"### Recommended Actions ###"},{"line_number":34,"context_line":"The recommended solution to this issue is to disable cache usage in the"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"3a961159_afa8d1db","line":31,"in_reply_to":"3a961159_ece440ae","updated":"2014-12-11 18:09:33.000000000","message":"Done (python-suds_0.4.1-2ubuntu1.1)","commit_id":"5730fa08aca3a9351b68e8bbfabb06b4b4872b31"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"8d0f4aa62d23e1c7d6ea88732ad3f291f390aa83","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"### Recommended Actions ###"},{"line_number":34,"context_line":"The recommended solution to this issue is to disable cache usage in the"},{"line_number":35,"context_line":"configuration as show:"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"  \u0027client.set_options(cache\u003dNone)\u0027"},{"line_number":38,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":7,"id":"3a961159_4cf39473","line":35,"updated":"2014-12-07 23:19:21.000000000","message":"change \"as show\" to \"as shown\"","commit_id":"5730fa08aca3a9351b68e8bbfabb06b4b4872b31"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"d53954a2c93de4934eea3d49c916001d01d1f65f","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"### Recommended Actions ###"},{"line_number":34,"context_line":"The recommended solution to this issue is to disable cache usage in the"},{"line_number":35,"context_line":"configuration as show:"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"  \u0027client.set_options(cache\u003dNone)\u0027"},{"line_number":38,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":7,"id":"3a961159_4f9dadbb","line":35,"in_reply_to":"3a961159_4cf39473","updated":"2014-12-11 18:09:33.000000000","message":"Done","commit_id":"5730fa08aca3a9351b68e8bbfabb06b4b4872b31"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"8d0f4aa62d23e1c7d6ea88732ad3f291f390aa83","unresolved":false,"context_lines":[{"line_number":37,"context_line":"  \u0027client.set_options(cache\u003dNone)\u0027"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"A fix has been released to oslo.vmware that disables the use of the disk"},{"line_number":40,"context_line":"cache by default. Cinder and Nova have both adjusted their requirements"},{"line_number":41,"context_line":"to include this fixed version. Deployers wishing to re-enable the cache"},{"line_number":42,"context_line":"should ascertain whether or not their vendor shipped suds package is"},{"line_number":43,"context_line":"susceptible and consider the above advice."}],"source_content_type":"application/octet-stream","patch_set":7,"id":"3a961159_6ce8507d","line":40,"updated":"2014-12-07 23:19:21.000000000","message":"what version of oslo.vmware?","commit_id":"5730fa08aca3a9351b68e8bbfabb06b4b4872b31"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"d53954a2c93de4934eea3d49c916001d01d1f65f","unresolved":false,"context_lines":[{"line_number":37,"context_line":"  \u0027client.set_options(cache\u003dNone)\u0027"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"A fix has been released to oslo.vmware that disables the use of the disk"},{"line_number":40,"context_line":"cache by default. Cinder and Nova have both adjusted their requirements"},{"line_number":41,"context_line":"to include this fixed version. Deployers wishing to re-enable the cache"},{"line_number":42,"context_line":"should ascertain whether or not their vendor shipped suds package is"},{"line_number":43,"context_line":"susceptible and consider the above advice."}],"source_content_type":"application/octet-stream","patch_set":7,"id":"3a961159_8fa315ff","line":40,"in_reply_to":"3a961159_6ce8507d","updated":"2014-12-11 18:09:33.000000000","message":"0.6.0 Done","commit_id":"5730fa08aca3a9351b68e8bbfabb06b4b4872b31"},{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"a160902fe5d73d1311a724667b4ac29d4fd462ec","unresolved":false,"context_lines":[{"line_number":43,"context_line":"susceptible and consider the above advice."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"### Contacts / References ###"},{"line_number":46,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0038"},{"line_number":47,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1341954"},{"line_number":48,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":49,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"3a961159_c98e0479","line":46,"updated":"2014-12-11 14:20:35.000000000","message":"No need for space before colon (:).","commit_id":"5730fa08aca3a9351b68e8bbfabb06b4b4872b31"},{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"1e7d3175eea2da7bf0e202451354f2120bec484f","unresolved":false,"context_lines":[{"line_number":43,"context_line":"susceptible and consider the above advice."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"### Contacts / References ###"},{"line_number":46,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0038"},{"line_number":47,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1341954"},{"line_number":48,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":49,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"3a961159_a3855008","line":46,"in_reply_to":"3a961159_c91e04bb","updated":"2014-12-11 16:27:21.000000000","message":"Ha, yes, I also realized I didn\u0027t like the space slash space in the second header. If possible, we could clean up the space colon problem all at once in another patch.","commit_id":"5730fa08aca3a9351b68e8bbfabb06b4b4872b31"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"a7f89846d0875d03cd74578eef3d1868d402ca95","unresolved":false,"context_lines":[{"line_number":43,"context_line":"susceptible and consider the above advice."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"### Contacts / References ###"},{"line_number":46,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0038"},{"line_number":47,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1341954"},{"line_number":48,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":49,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"3a961159_c91e04bb","line":46,"in_reply_to":"3a961159_c98e0479","updated":"2014-12-11 14:37:40.000000000","message":"By convention OSSNs have always used a space here. Now that\u0027s possibly a stupid convention and almost certainly my fault but it\u0027s still the current convention.","commit_id":"5730fa08aca3a9351b68e8bbfabb06b4b4872b31"},{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"a160902fe5d73d1311a724667b4ac29d4fd462ec","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"### Contacts / References ###"},{"line_number":46,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0038"},{"line_number":47,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1341954"},{"line_number":48,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":49,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":50,"context_line":"Suds: https://pypi.python.org/pypi/suds"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"3a961159_298a286a","line":47,"updated":"2014-12-11 14:20:35.000000000","message":"Launchpad","commit_id":"5730fa08aca3a9351b68e8bbfabb06b4b4872b31"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"d53954a2c93de4934eea3d49c916001d01d1f65f","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"### Contacts / References ###"},{"line_number":46,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0038"},{"line_number":47,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1341954"},{"line_number":48,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":49,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":50,"context_line":"Suds: https://pypi.python.org/pypi/suds"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"3a961159_cf699dbf","line":47,"in_reply_to":"3a961159_298a286a","updated":"2014-12-11 18:09:33.000000000","message":"Done","commit_id":"5730fa08aca3a9351b68e8bbfabb06b4b4872b31"},{"author":{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},"change_message_id":"fee208fb56c81d15dc44da87314bcf77e579c2fa","unresolved":false,"context_lines":[{"line_number":8,"context_line":"symlinks or run a privilege escalation or code execution attack."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Cinder, Nova, Grizzly, Havana, Icehouse"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"The Python \u0027suds\u0027 package is used by oslo.vmware to interface with SOAP"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"3a961159_3e9f8e04","line":11,"updated":"2014-12-12 17:07:16.000000000","message":"first 2 are components, last 3 are versions...does it matter?","commit_id":"762e408d5f729126a2374e412170acfad72f269a"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"cf044a6005528de11ac0a2a2198032bffd09e808","unresolved":false,"context_lines":[{"line_number":8,"context_line":"symlinks or run a privilege escalation or code execution attack."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Cinder, Nova, Grizzly, Havana, Icehouse"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"The Python \u0027suds\u0027 package is used by oslo.vmware to interface with SOAP"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"3a961159_b5ca379f","line":11,"in_reply_to":"3a961159_3e9f8e04","updated":"2014-12-17 16:24:53.000000000","message":"This is the standard way we list affected components and releases (for now).  This is fine to leave as is until we change the template.","commit_id":"762e408d5f729126a2374e412170acfad72f269a"},{"author":{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},"change_message_id":"fee208fb56c81d15dc44da87314bcf77e579c2fa","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Cinder, Nova, Grizzly, Havana, Icehouse"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"The Python \u0027suds\u0027 package is used by oslo.vmware to interface with SOAP"},{"line_number":15,"context_line":"service APIs and both Cinder and Nova have dependencies on oslo.vmware"},{"line_number":16,"context_line":"when using VMware drivers. By default suds uses an on-disk cache that"},{"line_number":17,"context_line":"places pickle files, serialised Python objects, into a known location"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"3a961159_3eb6ae8a","line":14,"updated":"2014-12-12 17:07:16.000000000","message":"cinder uses \u0027suds\u0027 directly. nova uses \u0027suds\u0027 directly in some versions and indirectly through oslo.vmware in other versions. Not sure if we need to bring that out. probably too much information","commit_id":"762e408d5f729126a2374e412170acfad72f269a"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"cf044a6005528de11ac0a2a2198032bffd09e808","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Cinder, Nova, Grizzly, Havana, Icehouse"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"The Python \u0027suds\u0027 package is used by oslo.vmware to interface with SOAP"},{"line_number":15,"context_line":"service APIs and both Cinder and Nova have dependencies on oslo.vmware"},{"line_number":16,"context_line":"when using VMware drivers. By default suds uses an on-disk cache that"},{"line_number":17,"context_line":"places pickle files, serialised Python objects, into a known location"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"3a961159_75a1afa8","line":14,"in_reply_to":"3a961159_3eb6ae8a","updated":"2014-12-17 16:24:53.000000000","message":"I don\u0027t think the exact dependency details (direct or indirect) matter too much for the purposes of this note.  Is suds used even when the VMware drivers are not being used?  If so, we should make that clear.  If suds is only used when the VMware drivers are used, then I think the note is fine as is.","commit_id":"762e408d5f729126a2374e412170acfad72f269a"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"38fb5f36a2674a395064160789543a1b27edee38","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Cinder, Nova, Grizzly, Havana, Icehouse"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"The Python \u0027suds\u0027 package is used by oslo.vmware to interface with SOAP"},{"line_number":15,"context_line":"service APIs and both Cinder and Nova have dependencies on oslo.vmware"},{"line_number":16,"context_line":"when using VMware drivers. By default suds uses an on-disk cache that"},{"line_number":17,"context_line":"places pickle files, serialised Python objects, into a known location"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"3a961159_15fdcb3b","line":14,"in_reply_to":"3a961159_75a1afa8","updated":"2014-12-17 16:30:03.000000000","message":"dims confirmed that suds is only used when the VMware drivers are used, so this is good to publish IMHO.","commit_id":"762e408d5f729126a2374e412170acfad72f269a"}]}