yahoo-eng-team team mailing list archive

[Jeremy Stanley <fungi@xxxxxxxxxxx>]

Switched the bug to public and marked the security advisory task wontfix
based on the above explanation.

** Information type changed from Private Security to Public

** Changed in: ossa
       Status: Incomplete => Won't Fix

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1370292

Title:
  Possible SQL Injection vulnerability in hyperv plugin

Status in OpenStack Neutron (virtual network service):
  New
Status in OpenStack Security Advisories:
  Won't Fix

Bug description:
  On this line:
  https://github.com/openstack/neutron/blob/master/neutron/plugins/hyperv/agent/utilsv2.py#L190
  a raw SQL query is being made with the parameters 'class_name' and
  'element_name'.  Class name appears to be a hardcoded value in the
  usage that I saw, but element_name looks like it is set from
  "switch_port_name".  If a malicious user is able to tamper with the
  switch port name, a SQL injection vulnerability exists.

  At least this is an unsafe programming practice.  A library such as
  sqlalchemy should be used, or at least prepared statements.

  If there is no way for a user to tamper with these parameters, this
  can be fixed in public and treated as security hardening rather than a
  vulnerability.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1370292/+subscriptions