Heat stack 'hidden' and heat.conf 'encrypt_parameters_and_properties' settings are not honored

[Alejandro Santoyo Gonzalez]

[Impact]

This is a potential security vulnerability. The upstream story has been marked as 'Vulnerability or Security-related' and is awaiting security triage: https://storyboard.openstack.org/#!/story/2010484

[Test Case]

After a stack is created using:

openstack stack create --parameter password=test123 -t simple_instance.yaml -e params.yaml my_simple_stack

where 'simple_instance.yaml' defines a simple VM with a 'hidden'
parameter as below:

  password:
    type: string
    hidden: true
    description: The password

'hidden' is honored when you run:

openstack stack show my_simple_stack | grep password
| | password: '******'

but that's not the case for the below command as the API returns the
'hidden' parameter in plain text:

openstack stack environment show my_simple_stack3 | grep password
  password: test123

This behavior is observed in Focal/Ussuri and Jammy/Yoga and happens
regardless of the user role used. Namely two users with either reader
or member (admin role as well but this may be by design) face the same
issue. For example, if user1 created the stack, both user1 and user2
(a user with either reader or admin role assigned) face the same issue
described above.

Also it doesn't matter if heat.conf contains
'encrypt_parameters_and_properties = true', the issue is observed
regardles of the value for this parameter.

Reproducer:
-----------

1. Create a simple stack where a 'hidden' parameter is used
2. Run 'openstack stack show <stack-id>', the hidden parameter will
appear masked.
3. Run 'openstack stack environment show <stack-id>' the hidden
parameter will appear in plain text.
4. Add 'encrypt_parameters_and_properties = true' to heat.conf and
restart the heat services
5. Repeat steps 1-3, issue should be reproduced
6. Set option in step 4 as 'false' and repeat steps 1-3, issue should
be reproduced

[Regression Potential]
This changes the behavior of the API. If software depends on a hidden parameter being returned, the code will need to update the parameter to not be hidden.

[Edward Hope-Morley (hopem)]

Patches: https://review.opendev.org/q/Ifc51ff6a4deab05002ccded59383416f9a586aa0

[Edward Hope-Morley (hopem)]

And fwiw sonce heat bugs are tracked in storyboard the actual bug raised is at https://storyboard.openstack.org/#!/story/2010484

[Corey Bryant (corey.bryant)]

This has been uploaded to the kinetic and jammy unapproved queues:
https://launchpad.net/ubuntu/kinetic/+queue?queue_state=1&queue_text=heat
https://launchpad.net/ubuntu/jammy/+queue?queue_state=1&queue_text=heat

[Steve Langasek (vorlon)]

Hello Alejandro, or anyone else affected,

Accepted heat into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/heat/1:19.0.0-0ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Steve Langasek (vorlon)]

Hello Alejandro, or anyone else affected,

Accepted heat into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/heat/1:18.0.0-0ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Chengen Du (chengendu)]

I have tested the following versions: 1:18.0.0-0ubuntu1.1 for jammy, 1:19.0.0-0ubuntu1.1 for kinetic. The 'stack environment show' command honors the 'hidden' parameter as expected.

[Launchpad Janitor (janitor)]

This bug was fixed in the package heat - 1:19.0.0-0ubuntu1.1

---------------
heat (1:19.0.0-0ubuntu1.1) kinetic; urgency=medium

  * d/gbp.conf: Create stable/zed branch.
  * d/p/honor-hidden-parameter.patch: Ensure get_environment() masks
    hidden parameters (LP: #1999665).

 -- Corey Bryant <email address hidden> Thu, 09 Mar 2023 09:36:52 -0500

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for heat has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package heat - 1:18.0.0-0ubuntu1.1

---------------
heat (1:18.0.0-0ubuntu1.1) jammy; urgency=medium

  * d/gbp.conf: Create stable/yoga branch.
  * d/p/honor-hidden-parameter.patch: Ensure get_environment() masks
    hidden parameters (LP: #1999665).

 -- Corey Bryant <email address hidden> Mon, 25 Apr 2022 09:55:34 -0400

[Corey Bryant (corey.bryant)]

The verification of the Stable Release Update for heat has completed successfully and the package has now been released to -updates. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Corey Bryant (corey.bryant)]

This bug was fixed in the package heat - 1:19.0.0-0ubuntu1.1~cloud0
---------------

 heat (1:19.0.0-0ubuntu1.1~cloud0) jammy-zed; urgency=medium
 .
   * New update for the Ubuntu Cloud Archive.
 .
 heat (1:19.0.0-0ubuntu1.1) kinetic; urgency=medium
 .
   * d/gbp.conf: Create stable/zed branch.
   * d/p/honor-hidden-parameter.patch: Ensure get_environment() masks
     hidden parameters (LP: #1999665).

[Corey Bryant (corey.bryant)]

The verification of the Stable Release Update for heat has completed successfully and the package has now been released to -updates. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Corey Bryant (corey.bryant)]

This bug was fixed in the package heat - 1:18.0.0-0ubuntu1.1~cloud0
---------------

 heat (1:18.0.0-0ubuntu1.1~cloud0) focal-yoga; urgency=medium
 .
   * New update for the Ubuntu Cloud Archive.
 .
 heat (1:18.0.0-0ubuntu1.1) jammy; urgency=medium
 .
   * d/gbp.conf: Create stable/yoga branch.
   * d/p/honor-hidden-parameter.patch: Ensure get_environment() masks
     hidden parameters (LP: #1999665).