Bug#1144989: trixie-pu: package aodh/20.0.0-2
Thomas Goirand <[email protected]>
| Newsgroups | gmane.linux.debian.devel.release |
|---|---|
| Message-ID | <178729854454.7545.13838969003874940039.reportbug__42781.3003932656$1787298692$gmane$org@zbuz.infomaniak.ch> |
Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:aodh User: [email protected] Usertags: pu Hi, [ Reason ] I'd like to upload aodh 20.0.0-2+deb13u1, in order to address: https://security.openstack.org/ossa/OSSA-2026-036.html aka: https://bugs.debian.org/1144879 [ Impact ] As per upstream announce: Aodh does not enforce project scope on the alarm listing API when the all_projects query parameter is supplied with a false value. A non-admin user holding only the reader role can list alarms belonging to other projects, optionally targeting a specific project, exposing alarm metadata such as webhook action URLs, signal endpoints, and project identifiers. [ Tests ] I've run OpenStack functional testing on my CI, and Aodh appeared to continue working. On top of this, the patch includes new tests. I've also deployed the patched version in production in our public cloud. [ Risks ] Minimum: well tested, and small patch. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable Please allow me to upload aodh/20.0.0-2+deb13u1 to p-u. Cheers, Thomas Goirand (zigo)
aodh_20.0.0-2+deb13u1.debdiff
(text/plain, 6.4 KB)
diff -Nru aodh-20.0.0/debian/changelog aodh-20.0.0/debian/changelog --- aodh-20.0.0/debian/changelog 2025-07-11 12:12:52.000000000 +0200 +++ aodh-20.0.0/debian/changelog 2026-08-12 09:57:24.000000000 +0200 @@ -1,3 +1,16 @@ +aodh (20.0.0-2+deb13u1) trixie; urgency=medium + + * CVE-2026-XXXXX / OSSA-2026-036: Aodh does not correctly enforce project + scope when the all_projects query parameter is present with a false value. + A non-admin project reader can list alarms belonging to other projects by + passing all_projects=false in a list query, optionally combined with a + foreign project_id to target a specific project. Leaked alarm data includes + trust webhook URLs, Heat signal endpoints, and project identifiers. Applied + upstream patch: "Fix all_projects=false bypass project scope" + (Closes: #1144879). + + -- Thomas Goirand <[email protected]> Wed, 12 Aug 2026 09:57:24 +0200 + aodh (20.0.0-2) unstable; urgency=medium * Set export OS_OSLO_MESSAGING_RABBIT__PROCESSNAME for all daemons. diff -Nru aodh-20.0.0/debian/patches/CVE-2026-XXXXX-aodh-lp-2161276-2025.1.patch aodh-20.0.0/debian/patches/CVE-2026-XXXXX-aodh-lp-2161276-2025.1.patch --- aodh-20.0.0/debian/patches/CVE-2026-XXXXX-aodh-lp-2161276-2025.1.patch 1970-01-01 01:00:00.000000000 +0100 +++ aodh-20.0.0/debian/patches/CVE-2026-XXXXX-aodh-lp-2161276-2025.1.patch 2026-08-12 09:57:24.000000000 +0200 @@ -0,0 +1,101 @@ +Description: Fix all_projects=false bypass project scope + Modify how all_projects is handled in queries using the alarms endpoint. + Previously using all_project=false would allow skipping a branch of the + code, which scopes requests to the current project. With the new code, + when all_projects=false is present, the project scoping is done as + originally intended. +Author: Jaromir Wysoglad <[email protected]> +Date: Tue, 28 Jul 2026 09:51:51 +0000 +Bug: https://launchpad.net/bugs/2161276 +Bug-Debian: https://bugs.debian.org/1144879 +Change-Id: Ia0ffb21b3928a1677dd97c0e26686f53fd9f9bef +Signed-off-by: Jaromir Wysoglad <[email protected]> +Origin: upstream, pre-OSSA mailing list +Last-Update: 2026-08-12 + +diff --git a/aodh/api/controllers/v2/alarms.py b/aodh/api/controllers/v2/alarms.py +index 92163c90..bf11b1c5 100644 +--- a/aodh/api/controllers/v2/alarms.py ++++ b/aodh/api/controllers/v2/alarms.py +@@ -887,11 +887,10 @@ class AlarmsController(rest.RestController): + 'only operations %s are allowed' % ALARM_QUERY_OPS_ALLOWED + ) + +- if 'all_projects' in keys: +- if v2_utils.get_query_value(q, 'all_projects', 'boolean'): +- rbac.enforce('get_alarms:all_projects', pecan.request, +- pecan.request.enforcer, target) +- keys.remove('all_projects') ++ if ('all_projects' in keys and ++ v2_utils.get_query_value(q, 'all_projects', 'boolean')): ++ rbac.enforce('get_alarms:all_projects', pecan.request, ++ pecan.request.enforcer, target) + else: + project_id = pecan.request.headers.get('X-Project-Id') + is_admin = rbac.is_admin(pecan.request, pecan.request.enforcer) +@@ -905,6 +904,7 @@ class AlarmsController(rest.RestController): + request_project = v2_utils.get_query_value(q, 'project_id') + if not is_admin and request_project != project_id: + raise base.ProjectNotAuthorized(request_project) ++ keys.discard('all_projects') + + for query in q: + if query.field in keys: +diff --git a/aodh/tests/functional/api/v2/test_alarm_scenarios.py b/aodh/tests/functional/api/v2/test_alarm_scenarios.py +index 4a997540..210a5d30 100644 +--- a/aodh/tests/functional/api/v2/test_alarm_scenarios.py ++++ b/aodh/tests/functional/api/v2/test_alarm_scenarios.py +@@ -219,6 +219,36 @@ class TestAlarms(TestAlarmsBase): + + _test('project_id') + ++ def test_get_alarm_all_projects_true_normal_user(self): ++ response = self.get_json( ++ '/alarms', ++ headers=self.auth_headers, ++ q=[{'field': 'all_projects', 'op': 'eq', 'value': 'true'}], ++ expect_errors=True, ++ status=403 ++ ) ++ faultstring = 'RBAC Authorization Failed' ++ self.assertIn(faultstring, ++ response.json['error_message']['faultstring']) ++ ++ def test_get_alarm_all_projects_false_normal_user(self): ++ alarms = self.get_json( ++ '/alarms', ++ headers=self.auth_headers, ++ q=[{'field': 'all_projects', 'op': 'eq', 'value': 'false'}] ++ ) ++ self.assertEqual(3, len(alarms)) ++ ++ def test_get_alarm_all_projects_false_normal_user_from_other_project(self): ++ auth_headers = copy.copy(self.auth_headers) ++ auth_headers['X-Project-Id'] = 'other-project' ++ alarms = self.get_json( ++ '/alarms', ++ headers=auth_headers, ++ q=[{'field': 'all_projects', 'op': 'eq', 'value': 'false'}] ++ ) ++ self.assertEqual(0, len(alarms)) ++ + def test_get_alarm_forbiden(self): + pf = os.path.abspath('aodh/tests/functional/api/v2/policy.yaml-test') + self.CONF.set_override('policy_file', pf, group='oslo_policy') +diff --git a/releasenotes/notes/fix-all-projects-bypass-project-scope-7b9a64d168f12353.yaml b/releasenotes/notes/fix-all-projects-bypass-project-scope-7b9a64d168f12353.yaml +new file mode 100644 +index 00000000..143cd241 +--- /dev/null ++++ b/releasenotes/notes/fix-all-projects-bypass-project-scope-7b9a64d168f12353.yaml +@@ -0,0 +1,9 @@ ++--- ++security: ++ - | ++ Fixed a vulnerability where passing ``all_projects=false`` in alarm ++ queries bypassed project scope filtering. Previously, the presence ++ of ``all_projects`` in the query caused the project scoping logic to ++ be skipped entirely, allowing non-admin users to list alarms from ++ all projects. Queries with ``all_projects=false`` or without ++ ``all_projects`` now correctly restrict results to the caller's project. +-- +2.43.0 diff -Nru aodh-20.0.0/debian/patches/series aodh-20.0.0/debian/patches/series --- aodh-20.0.0/debian/patches/series 2025-07-11 12:12:52.000000000 +0200 +++ aodh-20.0.0/debian/patches/series 2026-08-12 09:57:24.000000000 +0200 @@ -2,3 +2,4 @@ remove-wsmeext.sphinxext.patch remove-httpdomain-sphinx-ext.patch add-a-healthcheck_disable-file.patch +CVE-2026-XXXXX-aodh-lp-2161276-2025.1.patch