https://wiki.openstack.org/w/index.php?action=history&feed=atom&title=OSSN%2FOSSN-0101 2026-07-14T08:49:38Z Revision history for this page on the wiki MediaWiki 1.28.2 https://wiki.openstack.org/w/index.php?title=OSSN/OSSN-0101&diff=187748&oldid=prev 2026-07-09T18:33:19Z

<p>‎<span dir="auto"><span class="autocomment">Affected Services / Software</span></span></p> <table class="diff diff-contentalign-left" data-mw="interface"> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;' lang='en'> <td colspan='2' style="background-color: white; color:black; text-align: center;">← Older revision</td> <td colspan='2' style="background-color: white; color:black; text-align: center;">Revision as of 18:33, 9 July 2026</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l10" >Line 10:</td> <td colspan="2" class="diff-lineno">Line 10:</td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>== Affected Services / Software ==</div></td><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>== Affected Services / Software ==</div></td></tr> <tr><td class='diff-marker'>−</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>* nova<del class="diffchange diffchange-inline">: </del>&gt;=12.0.0</div></td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>* nova &gt;=12.0.0 <ins class="diffchange diffchange-inline">&lt;31.3.2, &gt;=32.0.0 &lt;32.2.2, &gt;=33.0.0 &lt;33.0.3</ins></div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>== Discussion ==</div></td><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>== Discussion ==</div></td></tr> <!-- diff cache key openstack_wiki:diff:version:1.11a:oldid:187747:newid:187748 --> </table>

Gouthamr https://wiki.openstack.org/w/index.php?title=OSSN/OSSN-0101&diff=187747&oldid=prev 2026-07-09T18:22:06Z

<p>Add OSSN-0101</p> <p><b>New page</b></p><div>= Nova console WebSocket proxy Origin allow-list poisoning =<br /> <br /> == Summary ==<br /> The Nova console WebSocket proxy mutates a shared, process-global<br /> oslo.config allowed_origins list on every incoming request by<br /> appending the client-controlled Host header value. Because oslo.config<br /> returns a cached list object, these appends persist for the lifetime<br /> of the proxy process. This permanently weakens the cross-origin<br /> protection on the console proxy and causes unbounded memory growth.<br /> <br /> == Affected Services / Software ==<br /> * nova: &gt;=12.0.0<br /> <br /> == Discussion ==<br /> On each request, the proxy appends the Host header to<br /> CONF.console.allowed_origins to allow the proxy's own hostname.<br /> This mutates the shared oslo.config cached list rather than<br /> operating on a copy, so any Host value ever seen is retained<br /> permanently for the life of the process.<br /> <br /> An unauthenticated attacker can inject arbitrary hostnames into<br /> the allow-list by sending requests with crafted Host headers,<br /> defeating the Origin check for all subsequent requests. The<br /> unbounded list growth also enables a slow memory exhaustion DoS.<br /> <br /> == Recommended Actions ==<br /> Apply the provided Nova patches. The fix copies the config list<br /> before appending, so mutations do not persist across requests.<br /> <br /> === Patches ===<br /> The following reviews contain the fix for this issue:<br /> <br /> * 2026.2/hibiscus (development): https://review.opendev.org/c/openstack/nova/+/995870<br /> * 2026.1/gazpacho: https://review.opendev.org/c/openstack/nova/+/995956<br /> * 2025.2/flamingo: https://review.opendev.org/c/openstack/nova/+/995957<br /> * 2025.1/epoxy: https://review.opendev.org/c/openstack/nova/+/995958<br /> <br /> == Credits ==<br /> Sergey r0binak Kanibor, Luntry<br /> <br /> == Contacts / References ==<br /> * Authors: Goutham Pacha Ravi, Red Hat<br /> <br /> * This OSSN: https://wiki.openstack.org/wiki/OSSN/OSSN-0101<br /> * Original Launchpad bug: https://bugs.launchpad.net/nova/+bug/2158919<br /> * Mailing List : [security-sig] tag on openstack-discuss@lists.openstack.org<br /> * OpenStack Security : https://security.openstack.org/<br /> * CVE: none</div>

Gouthamr