[Openstack-security] [Bug 1823104] Related fix proposed to nova (master)
Related fix proposed to branch: master
You received this bug notification because you are a member of OpenStack
Security SIG, which is subscribed to OpenStack.
CellMappingPayload in select_destinations versioned notification sends
sensitive database_connection and transport_url information
Status in OpenStack Compute (nova):
Status in OpenStack Compute (nova) stein series:
As of this change in Stein:
https://review.openstack.org/#/c/508506/28/nova/notifications/objects/request_spec.py at 334
Which is not yet officially released, but is in the 188.8.131.52rc1, the
select_destinations versioned notification payload during a move
operation (resize, cold/live migrate, unshelve, evacuate) will send
the cell database_connection URL and MQ transport_url information
which contains credentials to connect directly to the cell DB and MQ,
which even though notifications are meant to be internal within
openstack services, seems like a pretty bad idea. IOW, just because
it's internal to openstack doesn't mean nova needs to give ceilometer
the keys to it's cell databases.
There seems to be no justification in the change for *why* this
information was needed in the notification payload, it seemed to be
added simply for completeness.
To manage notifications about this bug go to: