CVE-2014-4615
The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2...
CVE-2014-4615 is a medium vulnerability (CVSS 5.0) in Openstack Neutron, published June 24, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.77%, the 86th percentile. Fixed in ceilometer 2014.1.2-1.
The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).
Exploit likelihood
What each source reports
NVD Score used
The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).
- Record
CVE-2014-4615- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).
- Record
CVE-2014-4615- Updated
- 2026-11-02
EUVDEUVD-2014-4542 No score
The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).
- Record
EUVD-2014-4542- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9wrh-vfjh-96rg No score
The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2...
The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).
- Record
GHSA-9wrh-vfjh-96rg- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV No score
The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).
- Record
CVE-2014-4615- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-4615 No score
The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).
- Record
DEBIAN-CVE-2014-4615- Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2014-4615 No score
The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).
- Record
UBUNTU-CVE-2014-4615- Updated
- 2026-11-02
OSVUSN-2311-1 No score
python-pycadf vulnerability
Zhi Kun Liu discovered that pyCADF incorrectly filtered certain tokens. An attacker could possibly use this issue to obtain authentication tokens used in REST requests.
- Record
USN-2311-1- Updated
- 2026-11-02
OSVUSN-2311-2 No score
ceilometer vulnerability
USN-2311-1 fixed vulnerabilities in pyCADF. This update provides the corresponding updates for OpenStack Ceilometer.
Original advisory details:
Zhi Kun Liu discovered that pyCADF incorrectly filtered certain tokens. An attacker could possibly use this issue to obtain authentication tokens used in REST requests.
- Record
USN-2311-2- Updated
- 2026-11-02
OSVUSN-2321-1 No score
neutron vulnerabilities
Liping Mao discovered that OpenStack Neutron did not properly handle requests for a large number of allowed address pairs. A remote authenticated attacker could exploit this to cause a denial of service. (CVE-2014-3555)
Zhi Kun Liu discovered that OpenStack Neutron incorrectly filtered certain tokens. An attacker could possibly use this issue to obtain authentication tokens used in REST requests. (CVE-2014-4615)
- Record
USN-2321-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ceilometerDebian:12 |
before 2014.1.2-1 | 2014.1.2-1 |
ceilometerDebian:13 |
before 2014.1.2-1 | 2014.1.2-1 |
ceilometerDebian:14 |
before 2014.1.2-1 | 2014.1.2-1 |
neutronDebian:12 |
before 2014.1.2-1 | 2014.1.2-1 |
neutronDebian:13 |
before 2014.1.2-1 | 2014.1.2-1 |
neutronDebian:14 |
before 2014.1.2-1 | 2014.1.2-1 |
python-pycadfDebian:12 |
before 0.5.1-1 | 0.5.1-1 |
python-pycadfDebian:13 |
before 0.5.1-1 | 0.5.1-1 |
python-pycadfDebian:14 |
before 0.5.1-1 | 0.5.1-1 |
openstack-ceilometerRed Hat:openstack:4::el6 |
before 0:2013.2.3-2.el6ost | 0:2013.2.3-2.el6ost |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openstack-ceilometer-alarmRed Hat:openstack:4::el6 |
before 0:2013.2.3-2.el6ost | 0:2013.2.3-2.el6ost |
openstack-ceilometer-apiRed Hat:openstack:4::el6 |
before 0:2013.2.3-2.el6ost | 0:2013.2.3-2.el6ost |
openstack-ceilometer-centralRed Hat:openstack:4::el6 |
before 0:2013.2.3-2.el6ost | 0:2013.2.3-2.el6ost |
openstack-ceilometer-collectorRed Hat:openstack:4::el6 |
before 0:2013.2.3-2.el6ost | 0:2013.2.3-2.el6ost |
openstack-ceilometer-commonRed Hat:openstack:4::el6 |
before 0:2013.2.3-2.el6ost | 0:2013.2.3-2.el6ost |
openstack-ceilometer-computeRed Hat:openstack:4::el6 |
before 0:2013.2.3-2.el6ost | 0:2013.2.3-2.el6ost |
python-ceilometerRed Hat:openstack:4::el6 |
before 0:2013.2.3-2.el6ost | 0:2013.2.3-2.el6ost |
ceilometerUbuntu:14.04:LTS |
before 2014.1.2-0ubuntu1.1, plus listed versions 2013.2~rc2-0ubuntu12013.2-0ubuntu12014.1~b1-0ubuntu12014.1~b2-0ubuntu12014.1~b3-0ubuntu1 Show 9 moreShow less2014.1~b3-0ubuntu22014.1~b3-0ubuntu32014.1~rc1-0ubuntu12014.1~rc2-0ubuntu12014.1~rc3-0ubuntu12014.1-0ubuntu12014.1-0ubuntu1.12014.1.1-0ubuntu12014.1.2-0ubuntu1 |
2014.1.2-0ubuntu1.1 |
neutronUbuntu:14.04:LTS |
before 1:2014.1.2-0ubuntu1.1, plus listed versions 1:2013.2~rc3-0ubuntu11:2013.2-0ubuntu11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu21:2014.1~b2-0ubuntu4 Show 10 moreShow less1:2014.1~b2-0ubuntu61:2014.1~b3-0ubuntu11:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1~rc2-0ubuntu31:2014.1~rc2-0ubuntu41:2014.1-0ubuntu11:2014.1-0ubuntu1.31:2014.1.1-0ubuntu21:2014.1.2-0ubuntu1 |
1:2014.1.2-0ubuntu1.1 |
python-pycadfUbuntu:14.04:LTS |
before 0.4.1-0ubuntu1.1, plus listed versions 0.2-10.2-1build10.4.1-0ubuntu1 |
0.4.1-0ubuntu1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
securityfocus.com/bid/68149
openwall.com/lists/oss-security/2014/06/25/6
secunia.com/advisories/60766
ubuntu.com/usn/USN-2311-1
Show 19 moreShow less
rhn.redhat.com/errata/RHSA-2014-1050.html
nvd.nist.gov/vuln/detail/CVE-2014-4615
github.com/advisories/GHSA-9wrh-vfjh-96rg
security-tracker.debian.org/tracker/CVE-2014-4615
access.redhat.com/errata/RHSA-2014:1050
bugzilla.redhat.com/show_bug.cgi?id=1112945
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1050.json
cve.org/CVERecord?id=CVE-2014-4615
ubuntu.com/security/CVE-2014-4615
lists.openstack.org/pipermail/openstack-announce/2014-June/000245.html