CVE-2019-17134
📋 TL;DR
This vulnerability allows attackers with access to the OpenStack Octavia management network to bypass client-certificate authentication and issue unauthorized configuration commands or retrieve sensitive information via HTTP requests to port 9443. It affects OpenStack Octavia deployments using Amphora Images with specific versions. The issue stems from incorrect SSL certificate requirement configuration in the agent.
💻 Affected Systems
- OpenStack Octavia
📦 What is this software?
Octavia by Opendev
Octavia by Opendev
Octavia by Opendev
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of load balancer infrastructure, allowing attackers to redirect traffic, intercept sensitive data, or disrupt services across the entire OpenStack deployment.
Likely Case
Unauthorized configuration changes to load balancers, service disruption, or information disclosure about the load balancing infrastructure.
If Mitigated
Limited impact if proper network segmentation isolates the management network and strict access controls are implemented.
🎯 Exploit Status
Exploitation requires network access to the management interface but no authentication. Simple HTTP requests can bypass the intended certificate authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.2, 3.2.0, 4.1.0 or later
Vendor Advisory: https://review.opendev.org/686541
Restart Required: Yes
Instructions:
1. Update OpenStack Octavia to version 2.1.2, 3.2.0, 4.1.0 or later. 2. Restart Octavia services. 3. Update Amphora Images to patched versions. 4. Verify certificate authentication is properly enforced.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to the management network (port 9443) to only authorized administrative systems using firewall rules.
iptables -A INPUT -p tcp --dport 9443 -s <trusted_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 9443 -j DROP
Certificate Enforcement
linuxManually configure the agent to enforce client certificate authentication by setting cert_reqs to ssl.CERT_REQUIRED.
Edit /etc/octavia/octavia.conf and ensure [amphora_agent] cert_reqs = CERT_REQUIRED
🧯 If You Can't Patch
- Implement strict network access controls to limit access to port 9443 on the management network
- Monitor all traffic to port 9443 for unauthorized access attempts and implement alerting
🔍 How to Verify
Check if Vulnerable:
Check Octavia version with: octavia-api --version. If version is within affected ranges and Amphora Images are used, the system is vulnerable.Check Version:
octavia-api --versionVerify Fix Applied:
After patching, test that HTTP requests without valid client certificates are rejected on port 9443. Verify version is 2.1.2+, 3.2.0+, or 4.1.0+.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to port 9443 in Octavia agent logs
- Failed certificate authentication events
- Unexpected configuration changes to load balancers
Network Indicators:
- HTTP traffic to port 9443 without proper TLS handshake
- Unusual traffic patterns from non-administrative systems to management network
SIEM Query:
source="octavia.log" AND "9443" AND ("unauthorized" OR "certificate" OR "authentication failed")🔗 References
- https://access.redhat.com/errata/RHSA-2019:3743
- https://access.redhat.com/errata/RHSA-2019:3788
- https://access.redhat.com/errata/RHSA-2020:0721
- https://review.opendev.org/686541
- https://review.opendev.org/686543
- https://review.opendev.org/686544
- https://review.opendev.org/686545
- https://review.opendev.org/686546
- https://review.opendev.org/686547
- https://security.openstack.org/ossa/OSSA-2019-005.html
- https://storyboard.openstack.org/#%21/story/2006660
- https://usn.ubuntu.com/4153-1/
- https://access.redhat.com/errata/RHSA-2019:3743
- https://access.redhat.com/errata/RHSA-2019:3788
- https://access.redhat.com/errata/RHSA-2020:0721
- https://review.opendev.org/686541
- https://review.opendev.org/686543
- https://review.opendev.org/686544
- https://review.opendev.org/686545
- https://review.opendev.org/686546
- https://review.opendev.org/686547
- https://security.openstack.org/ossa/OSSA-2019-005.html
- https://storyboard.openstack.org/#%21/story/2006660
- https://usn.ubuntu.com/4153-1/
