)]}'
{"security-notes/OSSN-0054":[{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"19ad39e593ce3c7858dbc9d8659a6948222e0e2f","unresolved":false,"context_lines":[{"line_number":17,"context_line":"of service condition by filling the database with useless session information."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"### Recommended Actions ###"},{"line_number":20,"context_line":"The django developers have released a fix for this issue which is included in"},{"line_number":21,"context_line":"software versions 1.4.21, 1.7.9 and 1.8.3. Horizon administrators should ensure"},{"line_number":22,"context_line":"that they are using an up to date version of Django to avoid being affected by"},{"line_number":23,"context_line":"this vulnerability."}],"source_content_type":"application/octet-stream","patch_set":2,"id":"da20952f_7296d095","line":20,"updated":"2015-09-02 21:46:07.000000000","message":"django is capitalized everywhere else, probably want to continue that for consistency.","commit_id":"7a4958484739dc3d110a43a23d013a1dcb2d0917"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"3ea9bd06857b15b28b32644d106ae0d81c3eee0c","unresolved":false,"context_lines":[{"line_number":17,"context_line":"of service condition by filling the database with useless session information."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"### Recommended Actions ###"},{"line_number":20,"context_line":"The django developers have released a fix for this issue which is included in"},{"line_number":21,"context_line":"software versions 1.4.21, 1.7.9 and 1.8.3. Horizon administrators should ensure"},{"line_number":22,"context_line":"that they are using an up to date version of Django to avoid being affected by"},{"line_number":23,"context_line":"this vulnerability."}],"source_content_type":"application/octet-stream","patch_set":2,"id":"da20952f_922124ff","line":20,"in_reply_to":"da20952f_7296d095","updated":"2015-09-02 22:09:28.000000000","message":"Done","commit_id":"7a4958484739dc3d110a43a23d013a1dcb2d0917"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"19ad39e593ce3c7858dbc9d8659a6948222e0e2f","unresolved":false,"context_lines":[{"line_number":22,"context_line":"that they are using an up to date version of Django to avoid being affected by"},{"line_number":23,"context_line":"this vulnerability."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Versions of Horizon prior to Kilo cannot run with the fixed version of Django."},{"line_number":26,"context_line":"Administrators can test if their deployment is affected by attempting to inject"},{"line_number":27,"context_line":"invalid sessions into the session store database using the following script and"},{"line_number":28,"context_line":"then querying the session store database to check if multiple \u0027aaaaa\u0027 session"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"da20952f_b20ea8e3","line":25,"updated":"2015-09-02 21:46:07.000000000","message":"I would recommend highlighting that this will necessitate an update to fix. I was disjointed by that sentence when reading through the first time. Maybe \"version of Django, and may require updating to a newer version of OpenStack.\"","commit_id":"7a4958484739dc3d110a43a23d013a1dcb2d0917"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"3ea9bd06857b15b28b32644d106ae0d81c3eee0c","unresolved":false,"context_lines":[{"line_number":22,"context_line":"that they are using an up to date version of Django to avoid being affected by"},{"line_number":23,"context_line":"this vulnerability."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Versions of Horizon prior to Kilo cannot run with the fixed version of Django."},{"line_number":26,"context_line":"Administrators can test if their deployment is affected by attempting to inject"},{"line_number":27,"context_line":"invalid sessions into the session store database using the following script and"},{"line_number":28,"context_line":"then querying the session store database to check if multiple \u0027aaaaa\u0027 session"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"da20952f_726d7031","line":25,"in_reply_to":"da20952f_b20ea8e3","updated":"2015-09-02 22:09:28.000000000","message":"Done","commit_id":"7a4958484739dc3d110a43a23d013a1dcb2d0917"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"19ad39e593ce3c7858dbc9d8659a6948222e0e2f","unresolved":false,"context_lines":[{"line_number":32,"context_line":"for i in {1..100}"},{"line_number":33,"context_line":"do"},{"line_number":34,"context_line":"  curl -b \"sessionid\u003daaaaa;\" http://HORIZON__IP/auth/login/ \u0026\u003e /dev/null"},{"line_number":35,"context_line":"done\u0027"},{"line_number":36,"context_line":"---- end example ----"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"If possible, affected users should upgrade to the Kilo or newer release of"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"da20952f_724b302c","line":35,"updated":"2015-09-02 21:46:07.000000000","message":"I seriously want to start an attack platform based off OSSNs. Probably wouldn\u0027t be too useful in my day job, but this and the keystone trust OSSN would be gold for a pentester who wanted to highlight how obtuse the logs are.","commit_id":"7a4958484739dc3d110a43a23d013a1dcb2d0917"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"3ea9bd06857b15b28b32644d106ae0d81c3eee0c","unresolved":false,"context_lines":[{"line_number":32,"context_line":"for i in {1..100}"},{"line_number":33,"context_line":"do"},{"line_number":34,"context_line":"  curl -b \"sessionid\u003daaaaa;\" http://HORIZON__IP/auth/login/ \u0026\u003e /dev/null"},{"line_number":35,"context_line":"done\u0027"},{"line_number":36,"context_line":"---- end example ----"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"If possible, affected users should upgrade to the Kilo or newer release of"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"da20952f_92684423","line":35,"in_reply_to":"da20952f_724b302c","updated":"2015-09-02 22:09:28.000000000","message":"Have at it !","commit_id":"7a4958484739dc3d110a43a23d013a1dcb2d0917"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"41080830fa70200aae6595337dea410dbcdaa10b","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"Django will record the session ID of web requests even when the request is from"},{"line_number":15,"context_line":"an unauthorized user. This allows an attacker to populate the session"},{"line_number":16,"context_line":"store database with invalid session information, potentially causing a denial"},{"line_number":17,"context_line":"of service condition by filling the database with useless session information."},{"line_number":18,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"da20952f_d2d31cd4","line":15,"updated":"2015-09-02 22:17:34.000000000","message":"(nit) The line wrapping is off here.","commit_id":"883c31163d87aa283f0bec4effeba931321c5024"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"41080830fa70200aae6595337dea410dbcdaa10b","unresolved":false,"context_lines":[{"line_number":17,"context_line":"of service condition by filling the database with useless session information."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"### Recommended Actions ###"},{"line_number":20,"context_line":"The django developers have released a fix for this issue which is included in"},{"line_number":21,"context_line":"software versions 1.4.21, 1.7.9 and 1.8.3. Horizon administrators should ensure"},{"line_number":22,"context_line":"that they are using an up to date version of Django to avoid being affected by"},{"line_number":23,"context_line":"this vulnerability."}],"source_content_type":"application/octet-stream","patch_set":3,"id":"da20952f_72b0108c","line":20,"updated":"2015-09-02 22:17:34.000000000","message":"(nit) Capitalize Django.","commit_id":"883c31163d87aa283f0bec4effeba931321c5024"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"c79cfabe689e4afd23f52ac9f233794337377b6b","unresolved":false,"context_lines":[{"line_number":17,"context_line":"of service condition by filling the database with useless session information."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"### Recommended Actions ###"},{"line_number":20,"context_line":"The django developers have released a fix for this issue which is included in"},{"line_number":21,"context_line":"software versions 1.4.21, 1.7.9 and 1.8.3. Horizon administrators should ensure"},{"line_number":22,"context_line":"that they are using an up to date version of Django to avoid being affected by"},{"line_number":23,"context_line":"this vulnerability."}],"source_content_type":"application/octet-stream","patch_set":3,"id":"da20952f_b5d0d2ca","line":20,"in_reply_to":"da20952f_72b0108c","updated":"2015-09-02 22:19:08.000000000","message":"Done","commit_id":"883c31163d87aa283f0bec4effeba931321c5024"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"41080830fa70200aae6595337dea410dbcdaa10b","unresolved":false,"context_lines":[{"line_number":36,"context_line":"---- end example ----"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"If possible, affected users should upgrade to the Kilo or newer release of"},{"line_number":39,"context_line":"Horizon, allowing them to use the fixed version of Django."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"### Contacts / References ###"},{"line_number":42,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0054"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"da20952f_722570c0","line":39,"updated":"2015-09-02 22:17:34.000000000","message":"Is any other workaround possible for users of earlier Horizon versions?  Is it possible to periodically flush out old/invalid sessions in addition to using some sort of rate limiting?","commit_id":"883c31163d87aa283f0bec4effeba931321c5024"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"c79cfabe689e4afd23f52ac9f233794337377b6b","unresolved":false,"context_lines":[{"line_number":36,"context_line":"---- end example ----"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"If possible, affected users should upgrade to the Kilo or newer release of"},{"line_number":39,"context_line":"Horizon, allowing them to use the fixed version of Django."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"### Contacts / References ###"},{"line_number":42,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0054"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"da20952f_35e5a2a7","line":39,"in_reply_to":"da20952f_722570c0","updated":"2015-09-02 22:19:08.000000000","message":"Not to my knowledge and not on the bug.","commit_id":"883c31163d87aa283f0bec4effeba931321c5024"},{"author":{"_account_id":7473,"name":"Grant Murphy","email":"grantcmurphy@gmail.com","username":"gm"},"change_message_id":"cf8dcfcd88cf24ab26455a915eaae1802da3855f","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Horizon uses the python based Django web framework. Older versions of this"},{"line_number":6,"context_line":"framework allow an unauthorized user to fill up the session store database"},{"line_number":7,"context_line":"causing a Horizon denial of service. A fix for Django is available but works"},{"line_number":8,"context_line":"only with Kilo and later versions of Horizon."}],"source_content_type":"application/octet-stream","patch_set":5,"id":"da20952f_78b0ef8b","line":5,"updated":"2015-09-02 22:49:09.000000000","message":"Python should be capitalized","commit_id":"acada9fc9e5d75c8f3e6bed3f2a08359a9b3e101"}]}