1
Candidate: CVE-2017-12440
4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12440
5
https://wiki.openstack.org/wiki/OSSN/OSSN-0080
7
Aodh as packaged in Openstack Ocata and Newton before change-ID
8
I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not
9
verify that trust IDs belong to the user when creating alarm action with
10
the scheme trust+http, which allows remote authenticated users with
11
knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token
12
and perform unspecified authenticated actions by adding an alarm action
13
with the scheme trust+http, and providing a trust id where Aodh is the
18
https://bugs.launchpad.net/ossn/+bug/1649333
24
upstream: https://review.openstack.org/#/c/493823/ (master)
25
upstream: https://review.openstack.org/#/c/493824/ (ocata)
26
upstream: https://review.openstack.org/#/c/493826/ (newton)
27
upstream_aodh: needs-triage
30
vivid/ubuntu-core_aodh: DNE
32
zesty_aodh: released (4.0.2-0ubuntu1)
33
artful_aodh: not-affected (5.0.0-0ubuntu1)
34
bionic_aodh: not-affected (5.0.0-0ubuntu1)
35
devel_aodh: not-affected (5.0.0-0ubuntu1)