)]}'
{"security-notes/OSSN-0046":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f24dc1a015f9c3e7a745d5482a94790795eacae6","unresolved":false,"context_lines":[{"line_number":6,"context_line":"debug. This can result in accidental information disclosures."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"### Affected Services / Software ###"},{"line_number":9,"context_line":"Blazar, Ceilometer, Cue, Gnocchi, Ironic, Kite, Libra, Tuskar"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Discussion ###"},{"line_number":12,"context_line":"Although it\u0027s best practice to run production environments with debugging"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da9b358b_5556f1d2","line":9,"updated":"2015-03-31 16:00:13.000000000","message":"which OpenStack versions are affected?","commit_id":"0326ddeb65592bcd8f2745ddc2984d6ef3c3c0d2"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"0e484735e0bfde92864e3430498c474da4c9035a","unresolved":false,"context_lines":[{"line_number":6,"context_line":"debug. This can result in accidental information disclosures."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"### Affected Services / Software ###"},{"line_number":9,"context_line":"Blazar, Ceilometer, Cue, Gnocchi, Ironic, Kite, Libra, Tuskar"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Discussion ###"},{"line_number":12,"context_line":"Although it\u0027s best practice to run production environments with debugging"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da9b358b_157aa9f1","line":9,"in_reply_to":"da9b358b_5556f1d2","updated":"2015-03-31 16:08:41.000000000","message":"Difficult to say, these aren\u0027t fully incubated projects so they don\u0027t follow the normal OpenStack release versioning.","commit_id":"0326ddeb65592bcd8f2745ddc2984d6ef3c3c0d2"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f24dc1a015f9c3e7a745d5482a94790795eacae6","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"* Retrieve a stack trace of failed Pecan calls"},{"line_number":20,"context_line":"* Retrieve a full list of environment variables containing potentially"},{"line_number":21,"context_line":"sensitive information"},{"line_number":22,"context_line":"* Set an execution breakpoint which hangs the service with a pdb shell"},{"line_number":23,"context_line":"resulting in a denial of service"},{"line_number":24,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da9b358b_150629ce","line":21,"updated":"2015-03-31 16:00:13.000000000","message":"what kind of sensitive information?  tenant data? passwords?","commit_id":"0326ddeb65592bcd8f2745ddc2984d6ef3c3c0d2"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f24dc1a015f9c3e7a745d5482a94790795eacae6","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"### Recommended Actions ###"},{"line_number":26,"context_line":"Until the services have been fixed such that the mode that Pecan runs in is"},{"line_number":27,"context_line":"decoupled from that of the service we advise not using the debug configuration"},{"line_number":28,"context_line":"for affected services in production environments."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"### Contacts / References ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da9b358b_f50865db","line":27,"updated":"2015-03-31 16:00:13.000000000","message":"service, we","commit_id":"0326ddeb65592bcd8f2745ddc2984d6ef3c3c0d2"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"dbb7096244df35265f3825d36433fd8126702938","unresolved":false,"context_lines":[{"line_number":19,"context_line":"* Retrieve a stack trace of failed Pecan calls"},{"line_number":20,"context_line":"* Retrieve a full list of environment variables containing potentially"},{"line_number":21,"context_line":"sensitive information such as API credentials, passwords etc."},{"line_number":22,"context_line":"* Set an execution breakpoint which hangs the service with a pdb shell"},{"line_number":23,"context_line":"resulting in a denial of service"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"### Recommended Actions ###"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"baa041b7_9d6e09c8","line":22,"updated":"2015-04-02 16:19:12.000000000","message":"shell,","commit_id":"2891dde9e780472d2a1735bc39b2e87c41f772b8"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"21c8f67d4456d59304d8b8ace6daa796368a6f63","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"When debug mode is set (via --debug or CONF.debug\u003dTrue) Pecan is also set to"},{"line_number":6,"context_line":"debug. This can result in accidental information disclosures."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"baa041b7_a399ae70","line":5,"updated":"2015-04-02 17:15:59.000000000","message":"Add \"for a service\" or something similar here.","commit_id":"da234ba6262b3bd130593ea024483da9e74e656c"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"8ce0b9620e6ff6875ceb234026a5c9467a1ea9d4","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"When debug mode is set (via --debug or CONF.debug\u003dTrue) Pecan is also set to"},{"line_number":6,"context_line":"debug. This can result in accidental information disclosures."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3ab451fb_c6ef3aaf","line":5,"in_reply_to":"baa041b7_a399ae70","updated":"2015-04-17 15:36:35.000000000","message":"Done","commit_id":"da234ba6262b3bd130593ea024483da9e74e656c"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"21c8f67d4456d59304d8b8ace6daa796368a6f63","unresolved":false,"context_lines":[{"line_number":6,"context_line":"debug. This can result in accidental information disclosures."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"### Affected Services / Software ###"},{"line_number":9,"context_line":"Blazar, Ceilometer, Cue, Gnocchi, Ironic, Kite, Libra, Tuskar"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Discussion ###"},{"line_number":12,"context_line":"Although it\u0027s best practice to run production environments with debugging"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"baa041b7_43c8a255","line":9,"updated":"2015-04-02 17:15:59.000000000","message":"It might be worth adding Pecan to this list.","commit_id":"da234ba6262b3bd130593ea024483da9e74e656c"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"8ce0b9620e6ff6875ceb234026a5c9467a1ea9d4","unresolved":false,"context_lines":[{"line_number":6,"context_line":"debug. This can result in accidental information disclosures."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"### Affected Services / Software ###"},{"line_number":9,"context_line":"Blazar, Ceilometer, Cue, Gnocchi, Ironic, Kite, Libra, Tuskar"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Discussion ###"},{"line_number":12,"context_line":"Although it\u0027s best practice to run production environments with debugging"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3ab451fb_66350645","line":9,"in_reply_to":"baa041b7_43c8a255","updated":"2015-04-17 15:36:35.000000000","message":"Done","commit_id":"da234ba6262b3bd130593ea024483da9e74e656c"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"21c8f67d4456d59304d8b8ace6daa796368a6f63","unresolved":false,"context_lines":[{"line_number":13,"context_line":"functionality disabled, experience shows us that many deployers choose to run"},{"line_number":14,"context_line":"OpenStack with debugging enabled to aid with administration and fault finding."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"When Pecan is running in debug mode the following capabilities are made"},{"line_number":17,"context_line":"available to anyone who can interact with the API service:"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"* Retrieve a stack trace of failed Pecan calls"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"baa041b7_c3e272d5","line":16,"updated":"2015-04-02 17:15:59.000000000","message":"(nit) Add a comma after \"mode\".","commit_id":"da234ba6262b3bd130593ea024483da9e74e656c"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"8ce0b9620e6ff6875ceb234026a5c9467a1ea9d4","unresolved":false,"context_lines":[{"line_number":13,"context_line":"functionality disabled, experience shows us that many deployers choose to run"},{"line_number":14,"context_line":"OpenStack with debugging enabled to aid with administration and fault finding."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"When Pecan is running in debug mode the following capabilities are made"},{"line_number":17,"context_line":"available to anyone who can interact with the API service:"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"* Retrieve a stack trace of failed Pecan calls"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3ab451fb_a94d2174","line":16,"in_reply_to":"baa041b7_c3e272d5","updated":"2015-04-17 15:36:35.000000000","message":"Done","commit_id":"da234ba6262b3bd130593ea024483da9e74e656c"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"21c8f67d4456d59304d8b8ace6daa796368a6f63","unresolved":false,"context_lines":[{"line_number":23,"context_line":"resulting in a denial of service"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"### Recommended Actions ###"},{"line_number":26,"context_line":"Until the services have been fixed such that the mode that Pecan runs in is"},{"line_number":27,"context_line":"decoupled from that of the service, we advise not using the debug configuration"},{"line_number":28,"context_line":"for affected services in production environments."},{"line_number":29,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"baa041b7_23dc7e11","line":26,"updated":"2015-04-02 17:15:59.000000000","message":"Has this been fixed for any services already?","commit_id":"da234ba6262b3bd130593ea024483da9e74e656c"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"8ce0b9620e6ff6875ceb234026a5c9467a1ea9d4","unresolved":false,"context_lines":[{"line_number":23,"context_line":"resulting in a denial of service"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"### Recommended Actions ###"},{"line_number":26,"context_line":"Until the services have been fixed such that the mode that Pecan runs in is"},{"line_number":27,"context_line":"decoupled from that of the service, we advise not using the debug configuration"},{"line_number":28,"context_line":"for affected services in production environments."},{"line_number":29,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3ab451fb_89526512","line":26,"in_reply_to":"baa041b7_23dc7e11","updated":"2015-04-17 15:36:35.000000000","message":"Done","commit_id":"da234ba6262b3bd130593ea024483da9e74e656c"}]}