Your message dated Mon, 07 Oct 2019 13:04:15 +0000
with message-id <[email protected]>
and subject line Bug#941897: fixed in octavia 4.0.0-6
has caused the Debian Bug report #941897,
regarding CVE-2019-17134: agent doesn't check for client certificate
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
941897: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=941897
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: octavia-agent
Version: 3.0.0-3
Severity: important
Tags: patch
The Octavia agent isn't enforcing 2 way certificates, meaning that anyone can
access the amphora-agent and manipulate it. I'm setting this bug as important,
as normally, in a reasonable setup, the load balancer management network
shouldn't be exposed to the public internet.
Patch is available here for all recent releases of Octavia:
https://review.opendev.org/#/q/I5619f5e40d7c9a2ee7741bf4664c0d2d08963992
Cheers,
Thomas Goirand (zigo)
--- End Message ---
--- Begin Message ---
Source: octavia
Source-Version: 4.0.0-6
We believe that the bug you reported is fixed in the latest version of
octavia, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <[email protected]> (supplier of updated octavia package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Mon, 07 Oct 2019 14:37:36 +0200
Source: octavia
Architecture: source
Version: 4.0.0-6
Distribution: unstable
Urgency: high
Maintainer: Debian OpenStack <[email protected]>
Changed-By: Thomas Goirand <[email protected]>
Closes: 941897
Changes:
octavia (4.0.0-6) unstable; urgency=high
.
* CVE-2019-17134: applied upstream patch (Closes: #941897):
- Add CVE-2019-17134_Fix_urgent_amphora_two-way_auth_security_bug.patch
Checksums-Sha1:
4becf543ab2d78859b20f41c607ddc1317f5b696 4049 octavia_4.0.0-6.dsc
58bdc715502def07cfa812e6afb72f527da1efaf 10308 octavia_4.0.0-6.debian.tar.xz
c8cef3b5949381773011d65a0fd58cf40b7ac5f9 19322 octavia_4.0.0-6_amd64.buildinfo
Checksums-Sha256:
bf7684c74693e17336ea71018eb427179643a0f79fde648355e1de445093c701 4049
octavia_4.0.0-6.dsc
e35e0ed6fc29105025d7a9ccc1e998ff6679a3d75370b861998a7af0addbe226 10308
octavia_4.0.0-6.debian.tar.xz
29ccc6acef873e85b61e5cbb30bdaf2d9d456a3f9c76c66615032a2f0994b995 19322
octavia_4.0.0-6_amd64.buildinfo
Files:
4122bcc086704c658b6aced8f37c3e4b 4049 net optional octavia_4.0.0-6.dsc
9c0740ef27619bfe4152c08a11334747 10308 net optional
octavia_4.0.0-6.debian.tar.xz
885bb58851992e517354a8c2ced0b6ce 19322 net optional
octavia_4.0.0-6_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAl2bMz4ACgkQ1BatFaxr
Q/61MhAAhpZ2/2MeXE41/2Yotrvfft/YMc6W7K3x4o1dZ8P1m75ziQnQW+Eiit+R
Ag0z54XcOqdv/4+iYV83MagQCO61hGOYtE7iC6Enft1hBrBIzLJZGaY0ex+J/Jdy
0Y8Cu6M7CW8gZpN98g4QaVlDRY8l5UQsjG8fMjoy2rCMBZ7dz9lJXKMj7qR5ulbX
dJpK/IUdKuvLCa4bPMXYswOk8JC0miNyWF0L1QroHq+JsiCLN0NpBS7SSu18LDnV
RpCmnZtFvTUuE7cjU67ckaOe7WwIMT7dGMFGqUWt7dTrCl/MupE/RWQINgvMzzPl
tAJl6Oi+2tuUEkKuM377fu3CDYbG5S571ku8tgwjj2+DKiTRyvM5mGrGRiPawmbk
rf7GXE7j2Ao9Qts8YZJf2LUyEjcYKW8n5C6ku7njV1hBbwz4P3Mlxs8XcoPsz9i2
LwvSn2Tw3lCu2eaWxfIRaH1/XTLeG5o7c2rUjfdMKl2RMJXo/Xo6olH951DFb3vp
EW2jqjADA3LOjlTPJoKO/gVZYwMfcjvfEPRCQna1vMI2o/GnPLUmmZQQBQ6X3XlL
2+JOXUzPRAmKUjL8mZOQfcCfrHuEBqVj+06NSUuj2woKYANSGCM1sHTDltf53owT
cpfIFGWHd8P5eoI6g4ejN0aLB9uk8MiVRN/5eT4ltX6QZtFP9O4=
=VqCI
-----END PGP SIGNATURE-----
--- End Message ---
