Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:gnocchi User: [email protected] Usertags: pu
Hi, [ Reason ] I would like to address the security issue OSSN-0112 / GHSA-cjq3-6hm7-q33w. The Github announce is here: https://github.com/gnocchixyz/gnocchi/security/advisories/GHSA-cjq3-6hm7-q33w At time of writting, the OpenStack security announce is still not merged, but can be see here: https://review.opendev.org/c/openstack/security-doc/+/1002392/15/security-notes/OSSN-0112.yaml [ Impact ] The vulnerability allows authenticated users to create metrics associated with resources belonging to other projects by bypassing authorization checks. As a consequence, it is possible for the attacker to make OpenStack write what it wants, and possibly (if the victime uses auto-scalling) make the victim auto-scaller Heat script be fooled into thinking it need to scale up, and spend too much money on a public cloud deployment. [ Tests ] The patch includes new unit tests. We also have put the fix into production in our public cloud deployment. [ Risks ] Not much, the patch is small, and easy to understand. It just checks if a resource is there within the scope of the user, meaning that it will not appear as existing if the resource is owned by someone else. Basically, the patch adds this: try: resource = pecan.request.indexer.get_resource( "generic", resource_id) except indexer.NoSuchResource: abort(404, str(indexer.NoSuchResource(resource_id))) (plus some tests) [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] Just as per above. Please accept gnocchi/4.6.5-1+deb13u1 Note I already uploaded it, as I've been told this is possible, and if no controvercy. Cheers, Thomas Goirand (zigo)
diff -Nru gnocchi-4.6.5/debian/changelog gnocchi-4.6.5/debian/changelog --- gnocchi-4.6.5/debian/changelog 2025-03-28 14:54:00.000000000 +0100 +++ gnocchi-4.6.5/debian/changelog 2026-09-23 12:38:32.000000000 +0200 @@ -1,3 +1,13 @@ +gnocchi (4.6.5-1+deb13u1) trixie; urgency=medium + + * OSSN-0112 / GHSA-cjq3-6hm7-q33w: Improper Access Control through + /metric/v1/metric via POST parameter "resource_id". Added patch: "Enforce + update resource policy metric creation" (Closes: #1150009): + - OSSN-0112_Enforce-update-resource-policy-metric-creation.patch + - CVE-2018-11774_OSSN-0112_Enforce-update-resource-policy-metric-c....patch + + -- Thomas Goirand <[email protected]> Wed, 23 Sep 2026 12:38:32 +0200 + gnocchi (4.6.5-1) unstable; urgency=medium * New upstream release. diff -Nru gnocchi-4.6.5/debian/patches/OSSN-0112_Enforce-update-resource-policy-metric-creation.patch gnocchi-4.6.5/debian/patches/OSSN-0112_Enforce-update-resource-policy-metric-creation.patch --- gnocchi-4.6.5/debian/patches/OSSN-0112_Enforce-update-resource-policy-metric-creation.patch 1970-01-01 01:00:00.000000000 +0100 +++ gnocchi-4.6.5/debian/patches/OSSN-0112_Enforce-update-resource-policy-metric-creation.patch 2026-09-23 12:38:32.000000000 +0200 @@ -0,0 +1,69 @@ +Description: Enforce update resource policy metric creation + When passing the resource_id in the request body + we should load the resource by ID and enforce the + `update resource` policy with the loaded resource. +Bug-Debian: https://bugs.debian.org/1150009 +Author: Tobias Urdin <[email protected]> +Date: Tue, 22 Sep 2026 17:05:44 +0200 +Change-Id: I519433b8e3d8e52daf22be67d9b3d9bfd2c6fa06 +Signed-off-by: Tobias Urdin <[email protected]> +Origin: upstream, https://github.com/gnocchixyz/gnocchi/commit/db32814f594bae25a8483c6d9af4e6378191b7c3 +Last-Update: 2026-10-05 + +diff --git a/gnocchi/rest/api.py b/gnocchi/rest/api.py +index 6e23a4c8..71c4116a 100644 +--- a/gnocchi/rest/api.py ++++ b/gnocchi/rest/api.py +@@ -595,6 +595,12 @@ class MetricsController(rest.RestController): + "reason": "Name cannot be null " + "if resource_id is not null"}) + original_resource_id, resource_id = resource_id ++ try: ++ resource = pecan.request.indexer.get_resource( ++ "generic", resource_id) ++ except indexer.NoSuchResource: ++ abort(404, str(indexer.NoSuchResource(resource_id))) ++ enforce("update resource", resource) + + enforce("create metric", { + "creator": creator, +diff --git a/gnocchi/tests/test_rest.py b/gnocchi/tests/test_rest.py +index 0171bde5..353e8d0d 100644 +--- a/gnocchi/tests/test_rest.py ++++ b/gnocchi/tests/test_rest.py +@@ -659,6 +659,35 @@ class MetricTest(RestTest): + metric2: []}, + result) + ++ def test_metric_with_resource_id_from_other_user(self): ++ resource_id = str(uuid.uuid4()) ++ self.app.post_json( ++ "/v1/resource/generic", ++ params={ ++ "id": resource_id, ++ "user_id": TestingApp.USER_ID, ++ "project_id": TestingApp.PROJECT_ID, ++ }, ++ ) ++ ++ with self.app.use_another_user(): ++ self.app.get( ++ "/v1/resource/generic/%s" % resource_id, ++ status=403, ++ ) ++ ++ with self.app.use_another_user(): ++ self.app.post_json( ++ "/v1/metric", ++ params={ ++ "archive_policy_name": "low", ++ "resource_id": resource_id, ++ "name": "cpu", ++ "unit": "ns", ++ }, ++ status=403, ++ ) ++ + + class ResourceTest(RestTest): + def setUp(self): diff -Nru gnocchi-4.6.5/debian/patches/series gnocchi-4.6.5/debian/patches/series --- gnocchi-4.6.5/debian/patches/series 2025-03-28 14:54:00.000000000 +0100 +++ gnocchi-4.6.5/debian/patches/series 2026-09-23 12:38:32.000000000 +0200 @@ -2,3 +2,4 @@ install-missing-files.patch add-disable_by_file_path.patch change-default-number-of-sacks.patch +OSSN-0112_Enforce-update-resource-policy-metric-creation.patch
