USN-8870-1: OpenStack Aodh and Watcher vulnerability
Ubuntu warns OpenStack Aodh and Watcher flaws can leak alarm metadata or trigger unauthorized action plans.
Ubuntu Security Notice USN-8870-1 covers authorization flaws in OpenStack Aodh and Watcher, reported by Chen YuXiang. Aodh did not correctly enforce project scoping in its alarm list API, and Watcher's webhook trigger endpoint did not apply authorization. An attacker could potentially read sensitive alarm metadata or trigger unauthorized action plans. The notice does not describe active exploitation.
- Aodh alarm list API lacked proper project scoping.
- Watcher webhook triggers did not check authorization.
- Impact is alarm metadata exposure or unauthorized action plans.
- USN-8870-1 does not report exploitation in the wild.
- Products
- OpenStack AodhOpenStack Watcher
- Organizations
- Ubuntu
From the original article
Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the OpenStack Watcher webhook trigger endpoint did not apply authorization. An attacker could possibly use this issue to access sensitive alarm metadata or trigger unauthorized action plans.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.