Comment 58 for bug 1409142
Revision history for this message
| Andrew Laski (alaski) wrote Re: Websocket Hijacking Vulnerability in Nova VNC Server (CVE-2015-0259) | #58 |
© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
bbfa235
(Get the code!)
Nice approach. There are some drawbacks with this that make backporting tricky. You've updated an rpc call here which means the version needs to be bumped. I will need to refresh myself on how this has been done on backports in the past. Additionally you can't assume that access_url is in connect_info as it's possible that a token was set before the upgrade, or that consoleauth has not been upgraded yet. So some additional error handling will be needed.