No limit in length of "user description " parameter results in DOS attack

[Jeremy Stanley]

Members of the VMT received the following report by E-mail:

There is also no limit on the length of user descriptions in another area. However, only administrators can modify this area, but I still recommend imposing a length limit

[Jeremy Stanley (fungi)]

Since this report concerns a possible security risk, an incomplete
security advisory task has been added while the core security
reviewers for the affected project or projects confirm the bug and
discuss the scope of any vulnerability along with potential
solutions.

Based on the reporter's assertion that this condition is only exploitable by cloud administrators, I don't think an embargo is warranted and this can just be treated as a hardening opportunity, class D in our report taxonomy: https://security.openstack.org/vmt-process.html#report-taxonomy

I included both Horizon and Keystone as it's not clear to me where the mitigation would occur.

[Jeremy Stanley (fungi)]

I've also subscribed lujiefsi, the original reporter.

[David Wilde (dave-wilde)]

I'm good with treating this as a hardening opportunity, and I also don't think an embargo is warranted. I think the mitigation will be in Keystone as that is where the field is defined [1] but we would probably need some client side validation within Horizon as well.

/ Dave

[1]: https://opendev.org/openstack/keystone/src/branch/master/keystone/common/validation/parameter_types.py#L54-L56

[Jeremy Stanley (fungi)]

Thanks, I've switched this report to public, and marked it as a hardening opportunity.