tripleo-heat-templates: unsafe pipeline ordering of swift staticweb middleware

[James Slagle]

Christian Schwede and Garth Mollett from Red Hat reported a
vulnerability in tripleo-heat-templates. When the staticweb middleware
is enabled, it is incorrectly configured before the keystone auth
middleware, reporting containers with enabled staticweb listings to
be empty and private while in fact being public accessible. A possible
unrecognized information leak might be the result. All setups configured
with staticweb middleware are affected.

[Emilien Macchi (emilienm)]

In attachment, the patch to apply in master.

[Dan Prince (dan-prince)]

+2 patch looks good

[Tristan Cacqueray (tristan-cacqueray)]

@Emilien, can we switch bug 1489749 to public now ?

[Emilien Macchi (emilienm)]

Since https://bugs.launchpad.net/swift/+bug/1489749 has nothing to do with puppet-swift anymore, I think we can switch it to public now.

[Tristan Cacqueray (tristan-cacqueray)]

Disclosure date is 2015-09-22.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/226541
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=1730d95acdbee7c7bbcfe1eba8a48ef2b0cc1476
Submitter: Jenkins
Branch: master

commit 1730d95acdbee7c7bbcfe1eba8a48ef2b0cc1476
Author: Emilien Macchi <email address hidden>
Date: Fri Sep 11 14:51:02 2015 -0400

    Put staticweb middleware after keystoneauth in proxy pipeline

    The staticweb middleware needs to be put after authentication
    middlewares to ensure correct functionality as documented in
    http://docs.openstack.org/developer/swift/middleware.html#staticweb

    Without this Swift sends a HTML response even if the request was done
    using a X-Auth-Token. This might result in a faulty handling of the response on
    the client side; for example, "swift stat containername" would report an empty,
    private container, while the container might actually be public readable with
    data stored in it.

    Closes-bug: 1494896
    Change-Id: Id48840e0041f8d272e08def292fbedfaf76bbfbb
    Co-Authored-By: Christian Schwede <email address hidden>

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/226907

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/226907
Committed: https://git.openstack.org/cgit/openstack/instack-undercloud/commit/?id=033f9d76b677eb2d01aa6c875365195019862aa0
Submitter: Jenkins
Branch: master

commit 033f9d76b677eb2d01aa6c875365195019862aa0
Author: Dan Prince <email address hidden>
Date: Wed Sep 23 14:03:48 2015 -0400

    Put staticweb middleware after keystoneauth in proxy

    The staticweb middleware needs to be put after authentication
    middlewares to ensure correct functionality as documented in
    http://docs.openstack.org/developer/swift/middleware.html#staticweb

    Without this Swift sends a HTML response even if the request was done
    using a X-Auth-Token. This might result in a faulty handling of the
    response on the client side; for example, "swift stat containername"
    would report an empty, private container, while the container might
    actually be public readable with data stored in it.

    Change-Id: Id008847376914752d7a30ce7bdd8c33a44bfb4fe
    Related-bug: 1494896

[Garth Mollett (gmollett)]

This should probably be posted to oss-sec along with the CVE (CVE-2015-5271) it was assigned now the bug has been opened.