Project

General

Profile

Actions
Copy link

Bug #22546

closed

CVE-2018-1097: curl api to change power state on ovirt compute_resource exposes credentials

Added by Steve D about 6 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
Urgent
Assignee:
Ori Rabin
Category:
Security
Target version:
1.16.1
Difficulty:
Triaged:
Bugzilla link:
Pull request:
https://github.com/theforeman/foreman/pull/5369, https://github.com/theforeman/foreman/pull/5373, https://github.com/theforeman/foreman/pull/5374, https://github.com/theforeman/foreman/pull/5375, https://github.com/theforeman/foreman/pull/5383, https://github.com/theforeman/foreman-packaging/pull/2331, https://github.com/theforeman/foreman/pull/5371, https://github.com/theforeman/foreman-packaging/pull/4320
Fixed in Releases:
Found in Releases:
1.15.6
Red Hat JIRA:

Description

Looks like the same issue as https://bugzilla.redhat.com/show_bug.cgi?id=1211613 so perhaps this is a regression.

curl -X PUT -H "Content-Type:application/json" -H "Accept:application/json" -k -u user:password -d '{"power_action": "on"}' https://foreman/api/v2/hosts/testhost.domain.name/power

{"power":{"raw":{"name":"testhost.domain.name","href":"/ovirt-engine/api/v3/vms/b67a994d-68f5-4cba-a515-c79536ce55fe","id":"b67a994d-68f5-4cba-a515-c79536ce55fe","client":{"api_entrypoint":"https://ovirt.domain.name/ovirt-engine/api/v3","credentials":{"username":"admin@internal","password":"unmaskedpassword"},
...

Related issues 1 (0 open — 1 closed)

Related to Foreman - Bug #23212: Changing power state gives: NameError: uninitialized constant Fog::Compute::OvirtClosed04/11/2018Actions
Actions
Copy link

Also available in: Atom PDF