[Openstack-security] [Bug 1823104] Re: CellMappingPayload in select_destinations versioned notification sends sensitive database_connection and transport_url information
Author: Matt Riedemann <mriedem.os at gmail.com>
Date: Wed Apr 3 22:09:52 2019 -0400
Remove CellMappingPayload database_connection and transport_url fields
Change I019e88fabd1d386c0d6395a7b1969315873485fd in Stein, which
is not yet officially released, exposes the unencrypted
database_connection URL and MQ transport_url to a CellMapping in
the select_destinations versioned notification CellMappingPayload.
While notifications are not meant to be consumed by end users of
the cloud but only internal services of the deployment, it still
seems like a bad idea to give the keys to the nova cell DB and MQ
to an external-to-nova service like ceilometer.
This change removes the fields from the CellMappingPayload and
bumps the major version to 2.0 to signal the change to consumers,
although I don't expect anything is consuming this yet but we should
follow standard versioning procedure anyway.
Note that notification consumers do not request a specific payload
version nor do they get a schema to perform their own backporting,
they just get what they get, so after this there should be no worry
about needing to support the 1.0 format for this payload.
(cherry picked from commit 3301449e736af81fdbd96fd3f396dd01b02beaf2)
** Changed in: nova/stein
Status: In Progress => Fix Committed
You received this bug notification because you are a member of OpenStack
Security SIG, which is subscribed to OpenStack.
CellMappingPayload in select_destinations versioned notification sends
sensitive database_connection and transport_url information
Status in OpenStack Compute (nova):
Status in OpenStack Compute (nova) stein series:
As of this change in Stein:
https://review.openstack.org/#/c/508506/28/nova/notifications/objects/request_spec.py at 334
Which is not yet officially released, but is in the 188.8.131.52rc1, the
select_destinations versioned notification payload during a move
operation (resize, cold/live migrate, unshelve, evacuate) will send
the cell database_connection URL and MQ transport_url information
which contains credentials to connect directly to the cell DB and MQ,
which even though notifications are meant to be internal within
openstack services, seems like a pretty bad idea. IOW, just because
it's internal to openstack doesn't mean nova needs to give ceilometer
the keys to it's cell databases.
There seems to be no justification in the change for *why* this
information was needed in the notification payload, it seemed to be
added simply for completeness.
To manage notifications about this bug go to: