| Name | CVE-2014-4615 |
| Description | The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request). |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| ceilometer (PTS) | jessie | 2014.1.3-6 | fixed |
| stretch | 1:7.0.1-5 | fixed | |
| buster | 1:11.0.1-5 | fixed | |
| bullseye | 1:15.0.0-3 | fixed | |
| bookworm | 1:19.0.0-3 | fixed | |
| sid, trixie | 1:23.0.0-1 | fixed | |
| neutron (PTS) | jessie | 2014.1.3-12 | fixed |
| stretch (security), stretch (lts), stretch | 2:9.1.1-3+deb9u3 | fixed | |
| buster (security), buster, buster (lts) | 2:13.0.7+git.2021.09.27.bace3d1890-0+deb10u1 | fixed | |
| bullseye (security), bullseye | 2:17.2.1-0+deb11u1 | fixed | |
| bookworm | 2:21.0.0-7 | fixed | |
| sid, trixie | 2:25.0.0-1 | fixed | |
| python-pycadf (PTS) | jessie | 0.5.1-1 | fixed |
| stretch | 2.4.0-1 | fixed | |
| buster | 2.7.0-2 | fixed | |
| bullseye, bookworm | 3.1.1-2 | fixed | |
| sid, trixie | 3.1.1-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| ceilometer | source | (unstable) | 2014.1.2-1 | |||
| neutron | source | (unstable) | 2014.1.2-1 | |||
| python-pycadf | source | (unstable) | 0.5.1-1 |
upstream patch: https://git.openstack.org/cgit/openstack/neutron/commit/?id=0324965a0c2987e5cad6276f011682dec184205f (neutron)
Upstream patch: https://git.openstack.org/cgit/openstack/ceilometer/commit/?id=2b6454f9f4e0585949ab68a91ed405755438d76e (ceilometer)
Upstream patch: https://git.openstack.org/cgit/openstack/ceilometer/commit/?id=264f3b0d9640edeac743f339786e0a3b22c0f6c2 (ceilometer)
Upstream patch: https://git.openstack.org/cgit/openstack/pycadf/commit/?id=966d4410a1a69e0a3af678442a1a965dae80d720 (pycadf)