CVE:CVE-2014-4615
CNNVD:CNNVD-201406-685
OpenStack是美国国家航空航天局（National Aeronautics and Space Administration）和美国Rackspace公司合作研发的一个云平台管理项目。PyCADF、Telemetry、Neutron和Oslo都是其中的项目；PyCADF是其中的一个CADF（云计算审计数据联盟工作组，用于开发DMTF审计事件数据模型）的Python实现；Telemetry（Ceilometer）是其中的一个能把OpenStack内所有的事件都收集起来并提供给监控、计费、面板等项目使用的子项目。
多款OpenStack产品的notifier中间件中存在安全漏洞。远程攻击者可通过读取v2/meters/http.request文件中的信息序列利用该漏洞获取‘X_AUTH_TOKEN’值。以下产品和版本受到影响：OpenStack PyCADF 0.5.0及之前版本，Telemetry (Ceilometer) 2013.2.4之前2013.2版本和2014.1.2之前2014.x版本，Neutron 2014.1.2之前2014.x版本和Juno-2之前Juno版本，Oslo。
solution:Upgrade redhat openstack to a higher version than 4.0,and avoid the version 4.0; Upgrade canonical ubuntu_linux to a higher version than 14.04,and avoid the version 14.04; Upgrade openstack neutron to a higher version than 2014.1,2014.1.1,juno1,and avoid the version 2014.1,2014.1.1,juno1; Upgrade openstack oslo to a higher version than -; Upgrade openstack pycadf to a higher version than 0.5.0,0.1,0.1.1,0.1.2,0.1.3,0.1.4,0.1.5,0.1.6,0.1.7,0.1.8,0.1.9,0.2,0.2.1,0.2.2,0.3,0.3.1,0.4,0.4.1,and avoid the version (,0.5.0],0.1,0.1.1,0.1.2,0.1.3,0.1.4,0.1.5,0.1.6,0.1.7,0.1.8,0.1.9,0.2,0.2.1,0.2.2,0.3,0.3.1,0.4,0.4.1; Upgrade openstack telemetry_(ceilometer) to a higher version than 2013.2,2014.1,and avoid the version 2013.2,2014.1