Description
The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | neutron +1 | 2014.1.2-1 | — |
| Debian 14 | python-pycadf | 0.5.1-1 | — |
| Debian 13 | neutron +1 | 2014.1.2-1 | — |
| Debian 13 | python-pycadf | 0.5.1-1 | — |
| Debian 12 | neutron +1 | 2014.1.2-1 | — |
| Debian 12 | python-pycadf | 0.5.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | ceilometer | 2014.1.2-0ubuntu1.1 | USN-2311-2 |
| Ubuntu 14.04 LTS | neutron | 1:2014.1.2-0ubuntu1.1 | USN-2321-1 |
| Ubuntu 14.04 LTS | python-pycadf | 0.4.1-0ubuntu1.1 | USN-2311-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 4 | python-ceilometer +7 | 2013.2.3-2.el6ost | RHSA-2014:1050 |
Advisories 4
- RHSA-2014:1050 Red Hat Security Advisory: openstack-ceilometer security and bug fix update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- USN-2311-1 python-pycadf vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-2311-2 ceilometer vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-2321-1 neutron vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
References
- 68149 vdb-entry
- [oss-security] 20140625 [OSSA 2014-021] User token leak to message queue in pyCADF notifier middleware (CVE-2014-4615) mailing-list
- 60766 third-party-advisory
- [oss-security] 20140623 CVE request for vulnerability in OpenStack Neutron, Ceilometer and pyCADF library mailing-list
- [oss-security] 20140624 Re: CVE request for vulnerability in OpenStack Neutron, Ceilometer and pyCADF library mailing-list
- USN-2311-1 vendor-advisory
- 60736 third-party-advisory
- RHSA-2014:1050 vendor-advisory
- 60643 third-party-advisory