solidfire driver ignores certificates

[Eric Brown]

The solidfire driver passes verify=False when initiating an https connection. This in effect bypasses any certificate verification and allows the user to be vulnerable to a man-in-the-middle attack. Certificates should always be trusted before passing credentials. To support cases with self-signed certificates, typically an option to ignore errors is exposed in a config file (cinder.conf).

https://github.com/openstack/cinder/blob/master/cinder/volume/drivers/solidfire.py#L198

        req = requests.post(url,
                            data=json.dumps(payload),
                            auth=(endpoint['login'], endpoint['passwd']),
                            verify=False,
                            timeout=30)

[Thierry Carrez (ttx)]

Since this report concerns a possible security risk, an incomplete security advisory task has been added while the core security reviewers for the affected project or projects confirm the bug and discuss the scope of any vulnerability along with potential solutions.

[Jeremy Stanley (fungi)]

This problem is already pointed out in public security hardening bug 1188189. The last mention of the solidfire driver there was still using httplib, but when change https://review.openstack.org/127399 switched it to requests it maintained compatible behavior (e.g. it did not suddenly start validating certificates).

I recommend we switch this to public and mark it as a duplicate report.

[Thierry Carrez (ttx)]

Agreed, let's open this (and mark it duplicate) on Monday unless someone disagrees.

[John Griffith (john-griffith)]

Late to the party, but for record keeping.. yes duplicate.