Executive brief
OpenStack's command-line client improperly handles deletion of access rules used to grant application credentials. When a user attempts to delete a non-existent access rule, the system incorrectly deletes other unrelated access rules instead, potentially disrupting legitimate service access and creating confusion about which applications retain permissions.
Technical details
A flaw in python-openstackclient's access rule deletion logic causes it to delete unrelated access rules when attempting to delete a non-existent rule. The vulnerability stems from the code incorrectly assuming access rules have a "name" property and using a flawed matching algorithm (CWE-237: Implicit Type Conversion). An authenticated user with access to delete access rules can trigger this by attempting to delete a rule ID that does not exist in their scope, which will cause the system to delete other existing access rules not associated with any application credentials. The fix, available in version 6.3.0, modifies the access rule commands to use only the resource ID for matching. Network access is required only to reach an OpenStack deployment; the vulnerability requires authenticated user interaction.
Affected products
- OpenStack python-openstackclient before 6.3.0
Timeline
- 2024-11-17: disclosed
- 2024-11-17: patched: Fixed in version 6.3.0