11211 port for memcached is not certified

[YuanQingbo]

After the user logs in to the openstack node, the data stored in memcached can be obtained with the command "memcached-tool 172.28.8.6: 11211 dump", and no authentication is required.

[Matt Riedemann (mriedem)]

Isn't this a limitation in memcached instead of nova?

[Sean Dague (sdague)]

This needs more explaination of the topology of the whole environment. memcached needs to be configured so that only the actual services consuming it have access (typically by only binding to localhost or being network fenced).

[Morgan Fainberg (mdrnstm)]

I concur with what Sean said.

I'd classify this as a documentation bug (at most) and a Class E https://security.openstack.org/vmt-process.html#incident-report-taxonomy.

[Morgan Fainberg (mdrnstm)]

Since this report concerns a possible security risk, an incomplete security advisory task has been added while the core security reviewers for the affected project or projects confirm the bug and discuss the scope of any vulnerability along with potential solutions.

[Launchpad Janitor (janitor)]

[Expired for OpenStack Compute (nova) because there has been no activity for 60 days.]

[Jeremy Stanley (fungi)]

Since this was originally opened as Public there wasn't much point in switching it to Private Security once all the nova bug subscribers were notified of it, so I've set it back to Public.

At this point, what consensus there is seems to be that this is an issue which should be corrected in documentation and/or a concern with memcached rather than any OpenStack software. It probably falls into either report class B2 (A vulnerability without a complete fix yet, security note for all versions, e.g., poor architecture / design) or C2 (A vulnerability, but not in OpenStack supported code, e.g., in a dependency) in our taxonomy, and so should not need an advisory: https://security.openstack.org/vmt-process.html#incident-report-taxonomy

[Luke Hinds (lhinds)]

as sdague states, memcached should not be listening on any sort of public interface, and this is covered in docs already:

https://docs.openstack.org/newton/install-guide-rdo/environment-memcached.html

[Luke Hinds (lhinds)]

just noticed the above was for RDO, however its the same for all dists:

https://docs.openstack.org/install-guide/environment-memcached-ubuntu.html