Switched the bug to public and marked the security advisory task wontfix
based on the above explanation.
** Information type changed from Private Security to Public
** Changed in: ossa
Status: Incomplete => Won't Fix
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1370292
Title:
Possible SQL Injection vulnerability in hyperv plugin
Status in OpenStack Neutron (virtual network service):
New
Status in OpenStack Security Advisories:
Won't Fix
Bug description:
On this line:
https://github.com/openstack/neutron/blob/master/neutron/plugins/hyperv/agent/utilsv2.py#L190
a raw SQL query is being made with the parameters 'class_name' and
'element_name'. Class name appears to be a hardcoded value in the
usage that I saw, but element_name looks like it is set from
"switch_port_name". If a malicious user is able to tamper with the
switch port name, a SQL injection vulnerability exists.
At least this is an unsafe programming practice. A library such as
sqlalchemy should be used, or at least prepared statements.
If there is no way for a user to tamper with these parameters, this
can be fixed in public and treated as security hardening rather than a
vulnerability.
To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1370292/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
