yahoo-eng-team team mailing list archive

[Alessandro Pilotti <1370292@xxxxxxxxxxxxxxxxxx>]

Not a bug as by discussion above, thanks

** Changed in: neutron
       Status: Incomplete => Invalid

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1370292

Title:
  Possible SQL Injection vulnerability in hyperv plugin

Status in neutron:
  Invalid
Status in OpenStack Security Advisory:
  Won't Fix

Bug description:
  On this line:
  https://github.com/openstack/neutron/blob/master/neutron/plugins/hyperv/agent/utilsv2.py#L190
  a raw SQL query is being made with the parameters 'class_name' and
  'element_name'.  Class name appears to be a hardcoded value in the
  usage that I saw, but element_name looks like it is set from
  "switch_port_name".  If a malicious user is able to tamper with the
  switch port name, a SQL injection vulnerability exists.

  At least this is an unsafe programming practice.  A library such as
  sqlalchemy should be used, or at least prepared statements.

  If there is no way for a user to tamper with these parameters, this
  can be fixed in public and treated as security hardening rather than a
  vulnerability.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1370292/+subscriptions