Ubuntu 14.04 : ceilometer vulnerability (USN-2311-2)

Ubuntu Security Notice (C) 2014 Canonical, Inc. / NASL script (C) 2014 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing a security-related patch.

Description :

USN-2311-1 fixed vulnerabilities in pyCADF. This update provides the
corresponding updates for OpenStack Ceilometer.

Zhi Kun Liu discovered that pyCADF incorrectly filtered certain
tokens. An attacker could possibly use this issue to obtain
authentication tokens used in REST requests.

Solution :

Update the affected ceilometer-common package.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)

Family: Ubuntu Local Security Checks

Nessus Plugin ID: 77320 ()

Bugtraq ID:

CVE ID: CVE-2014-4615