OpenStack Compute (nova)

  1. Bug #1325128
  2. Comment #19

Comment 19 for bug 1325128

Revision history for this message
John Garbutt (johngarbutt) wrote : Re: nova metadata does not use a constant time compare for validating an HMAC token (CVE-2014-3517)

I am +2 on russell's patch (assuming it passes gate tests, etc), as it seems to do the right thing, as far as I can tell from that article.

I would love to get someone to have time to do a manual test of that patch, but I think it makes sense.