Bug 598940 – <sys-cluster/heat-7.0.0-r1 - template source URL allows network port scan (CVE-2016-9185)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Matthew Thode ( prometheanfire ) 2016-11-04 14:47:30 UTC]

Launching a new Heat stack and giving the template from an URL like
  http://localhost:22
  
  Results in an error message like:
  
  ERROR: Could not retrieve template: Failed to retrieve template:
  ('Connection aborted.', BadStatusLine('SSH-2.0-OpenSSH_6.6.1\r\n',))
  
  This is a security issue as it allows users to scan the network for
  listening ports.

Reproducible: Always

[Comment 1 Matthew Thode ( prometheanfire ) 2016-11-04 14:48:50 UTC]

cleaned up

[Comment 2 GLSAMaker/CVETool Bot 2016-11-26 00:59:21 UTC]

CVE-2016-9185 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9185):
  In OpenStack Heat, by launching a new Heat stack with a local URL an
  authenticated user may conduct network discovery revealing internal network
  configuration. Affected versions are <=5.0.3, >=6.0.0 <=6.1.0, and ==7.0.0.

[Comment 3 Aaron Bauman (RETIRED) 2016-11-26 01:00:37 UTC]

GLSA Vote: No