Skip to content

Commit da199c4

Browse files
Pearl1594Pearl1594
authored
Advisory for the release of LTS 4.19.3.0 & 4.20.1.0 with security fixes (#322)
1 parent da58942 commit da199c4

File tree

4 files changed

+199
-8
lines changed

4 files changed

+199
-8
lines changed

‎blog/2025-06-10-cloudstack-4.19.3.0-4.20.1.0-release/index.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -61,13 +61,13 @@ https://docs.cloudstack.apache.org/
6161

6262
## Downloads
6363

64-
The official source code for the 4.19.3.0 and 4.20.1.0 releases can be downloaded from our downloads page:https://cloudstack.apache.org/downloads
64+
The official source code for the 4.19.3.0 and 4.20.1.0 releases can be downloaded from our [downloads page](/downloads).
6565

6666
In addition to the official source code release, individual contributors have also made convenience binaries available on the Apache CloudStack download page, and can be found at:
6767

6868
https://download.cloudstack.org/el/7/
69-
https://download.cloudstack.org/el/8/
70-
https://download.cloudstack.org/el/9/
71-
https://download.cloudstack.org/suse/15
72-
https://download.cloudstack.org/ubuntu/dists/
73-
https://www.shapeblue.com/packages/
69+
<br/>https://download.cloudstack.org/el/8/
70+
<br/>https://download.cloudstack.org/el/9/
71+
<br/>https://download.cloudstack.org/suse/15
72+
<br/>https://download.cloudstack.org/ubuntu/dists/
73+
<br/>https://www.shapeblue.com/packages/

‎blog/2025-06-10-release-advisory-4.19.3.0-4.20.1.0/banner.png‎

262 KB
Loading

‎blog/2025-06-10-release-advisory-4.19.3.0-4.20.1.0/index.md‎

Lines changed: 191 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
---
2+
layout: post
3+
title: "[ADVISORY] Security Improvements in Apache CloudStack 4.19.3.0 and 4.20.1.0"
4+
tags: [announcement]
5+
authors: [pearl]
6+
slug: cve-advisories-4.19.3.0-4.20.1.0
7+
---
8+
9+
[![](banner.png "Security Improvements in Apache CloudStack 4.19.3.0 and 4.20.1.0")](/blog/lts-release-advisory-4.19.3.0-4.20.1.0)
10+
11+
The Apache CloudStack project announces the LTS release of [4.19.3.0](https://github.com/apache/cloudstack/releases/tag/4.19.3.0) and [4.20.1.0](https://github.com/apache/cloudstack/releases/tag/4.20.1.0) that address the following security issues:
12+
13+
- CVE-2025-26521 (severity 'Critical')
14+
- CVE-2025-30675 (severity 'Low')
15+
- CVE-2025-47713 (severity 'Critical')
16+
- CVE-2025-47849 (severity 'Moderate')
17+
- CVE-2025-22829 (severity 'Low')
18+
19+
<!-- truncate -->
20+
21+
## [CVE-2025-26521](https://www.cve.org/CVERecord?id=CVE-2025-26521): CKS cluster in project exposes user API keys
22+
23+
When an Apache CloudStack user-account creates a CKS-based Kubernetes cluster in a project, the API key and the secret key of the 'kubeadmin' user of the caller account are used to create the secret config in the CKS-based Kubernetes cluster. A member of the project who can access the CKS-based Kubernetes cluster, can also access the API key and secret key of the 'kubeadmin' user of the CKS cluster's creator's account. An attacker who's a member of the project can exploit this to impersonate and perform privileged actions that can result in complete compromise of the confidentiality, integrity, and availability of resources owned by the creator's account.
24+
25+
CKS users are recommended to upgrade to version 4.19.3.0 or 4.20.1.0, which fixes this issue.
26+
27+
### Updating Existing Kubernetes Clusters in Projects
28+
29+
A **service account** should be created for each project to provide limited access specifically for Kubernetes cluster providers and autoscaling. Follow the steps below to create a new service account, update the secret inside the cluster, and regenerate existing API and service keys:
30+
31+
#### 1. Create a New Service Account
32+
33+
Create a new account using the role "Project Kubernetes Service Role" with the following details:
34+
35+
| Field | Value |
36+
|----------------|--------------------------------------------------|
37+
| Account Name | kubeadmin-<FIRST_EIGHT_CHARACTERS_OF_PROJECT_ID> |
38+
| First Name | Kubernetes |
39+
| Last Name | Service User |
40+
| Account Type | 0 (Normal User) |
41+
| Role ID | <ID_OF_SERVICE_ROLE> |
42+
43+
#### 2. Add the Service Account to the Project
44+
45+
Add this account to the **project** where the Kubernetes cluster(s) are hosted.
46+
47+
#### 3. Generate API and Secret Keys
48+
49+
Generate **API Key** and **Secret Key** for the default user of this account.
50+
51+
#### 4. Update the CloudStack Secret in the Kubernetes Cluster
52+
53+
Create a temporary file `/tmp/cloud-config` with the following data:
54+
55+
```
56+
api-url = <API_URL>     # For example: <MS_URL>/client/api
57+
api-key = <SERVICE_USER_API_KEY>
58+
secret-key = <SERVICE_USER_SECRET_KEY>
59+
project-id = <PROJECT_ID>
60+
```
61+
62+
Delete the existing secret using kubectl and Kubernetes cluster config:
63+
64+
```
65+
   ./kubectl --kubeconfig kube.conf -n kube-system delete secret cloudstack-secret
66+
```
67+
68+
Create a new secret using kubectl and Kubernetes cluster config:
69+
70+
```
71+
    ./kubectl --kubeconfig kube.conf -n kube-system create secret generic cloudstack-secret --from-file=/tmp/cloud-config
72+
```
73+
74+
Remove the temporary file:
75+
76+
```
77+
    rm /tmp/cloud-config
78+
```
79+
80+
#### 5. Regenerate API and Secret Keys
81+
82+
Regenerate the API and secret keys for the **original user account** that was used to create the Kubernetes cluster.
83+
84+
85+
## [CVE-2025-30675](https://www.cve.org/CVERecord?id=CVE-2025-30675): Unauthorised template/ISO list access to the domain/resource admins
86+
87+
In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs. A malicious Domain Admin or Resource Admin can exploit this issue by intentionally specifying the 'domainid' parameter along with the 'filter=self' or 'filter=selfexecutable' values. This allows the attacker to gain unauthorized visibility into templates and ISOs under the ROOT domain.
88+
A malicious admin can enumerate and extract metadata of templates and ISOs that belong to unrelated domains, violating isolation boundaries and potentially exposing sensitive or internal configuration details. This vulnerability has been fixed by ensuring the domain resolution strictly adheres to the caller's scope rather than defaulting to the ROOT domain.
89+
90+
Affected users are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0.
91+
92+
## [CVE-2025-47713](https://www.cve.org/CVERecord?id=CVE-2025-47713): Domain Admin can reset Admin password in Root Domain
93+
94+
A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can reset the password of user-accounts of Admin role type. This operation is not appropriately restricted and allows the attacker to assume control over higher-privileged user-accounts. A malicious Domain Admin attacker can impersonate an Admin user-account and gain access to sensitive APIs and resources that could result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of infrastructure managed by CloudStack.
95+
96+
Users are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0, which fixes the issue with the following:
97+
98+
- Strict validation on Role Type hierarchy: the caller's user-account role must be equal to or higher than the target user-account's role.
99+
- API privilege comparison: the caller must possess all privileges of the user they are operating on.
100+
- Two new domain-level settings (restricted to the default Admin):
101+
- `role.types.allowed.for.operations.on.accounts.of.same.role.type`: Defines which role types are allowed to act on users of the same role type.
102+
Default: `"Admin, DomainAdmin, ResourceAdmin"`.
103+
- `allow.operations.on.users.in.same.account`: Allows/disallows user operations within the same account.
104+
Default: `true`.
105+
106+
107+
## [CVE-2025-47849](https://www.cve.org/CVERecord?id=CVE-2025-47849): Insecure access of user's API/Secret Keys in the same domain
108+
109+
A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can get the API key and secret key of user-accounts of Admin role type in the same domain. This operation is not appropriately restricted and allows the attacker to assume control over higher-privileged user-accounts. A malicious Domain Admin attacker can impersonate an Admin user-account and gain access to sensitive APIs and resources that could result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of infrastructure managed by CloudStack.
110+
111+
Users are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0, which fixes the issue with the following:
112+
113+
- Strict validation on Role Type hierarchy: the caller's user-account role must be equal to or higher than the target user-account's role.
114+
- API privilege comparison: the caller must possess all privileges of the user they are operating on.
115+
- Two new domain-level settings (restricted to the default Admin):
116+
- `role.types.allowed.for.operations.on.accounts.of.same.role.type`: Defines which role types are allowed to act on users of the same role type.
117+
Default: `"Admin, DomainAdmin, ResourceAdmin"`.
118+
- `allow.operations.on.users.in.same.account`: Allows/disallows user operations within the same account.
119+
Default: `true`.
120+
121+
122+
## [CVE-2025-22829](https://www.cve.org/CVERecord?id=CVE-2025-22829): Unauthorised access to dedicated resources in Quota plugin
123+
124+
The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0.0 environments, where this plugin is enabled and have access to specific APIs can enable or disable reception of quota-related emails for any account in the environment and list their configurations.
125+
126+
Quota plugin users using CloudStack 4.20.0.0 are recommended to upgrade to CloudStack version 4.20.1.0, which fixes this issue.
127+
128+
129+
## Credits
130+
131+
The CVEs are credited to the following reporters:
132+
133+
- CVE-2025-26521:
134+
- Wei Zhou (weizhou@apache.org)
135+
136+
- CVE-2025-30675:
137+
- Bernardo De Marco Gonçalves <bernardomg2004@gmail.com>
138+
139+
- CVE-2025-47713:
140+
- Scott Schmitz <sschmitz@ussignal.com>
141+
142+
- CVE-2025-47849:
143+
- Kevin <kli74@apple.com>
144+
- Scott Schmitz <sschmitz@ussignal.com>
145+
146+
- CVE-2025-22829:
147+
- Fabricio Duarte <fabricio.duarte.jr@gmail.com>
148+
149+
## Affected versions:
150+
151+
152+
- CVE-2025-26521:
153+
- Apache CloudStack 4.17.0.0 through 4.19.2.0
154+
- Apache CloudStack 4.17.0.0 through 4.20.1.0
155+
156+
- CVE-2025-30675:
157+
- Apache CloudStack 4.0.0 through 4.19.2.0
158+
- Apache CloudStack 4.0.0 through 4.20.0.0
159+
160+
- CVE-2025-47713:
161+
- Apache CloudStack 4.10.0.0 through 4.19.2.0
162+
- Apache CloudStack 4.10.0.0 through 4.20.0.0
163+
164+
- CVE-2025-47849:
165+
- Apache CloudStack 4.10.0.0 through 4.19.2.0
166+
- Apache CloudStack 4.10.0.0 through 4.20.0.0
167+
168+
- CVE-2025-22829:
169+
- Apache CloudStack 4.20.0.0
170+
171+
## Resolution
172+
173+
Users are recommended to upgrade to version 4.19.3.0, 4.20.1.0 or later, which addresses these issues. Additionally, users on a version older than 4.20.0.0 are advised to skip 4.20.0.0 and upgrade to 4.20.1.0 instead.
174+
175+
## Downloads and Documentation
176+
177+
The official source code for the 4.19.3.0 and 4.20.1.0 releases can be downloaded from the project [downloads page](/downloads).
178+
179+
The 4.19.3.0 and 4.20.1.0 release notes can be found at:
180+
181+
- https://docs.cloudstack.apache.org/en/4.19.3.0/releasenotes/about.html
182+
- https://docs.cloudstack.apache.org/en/4.20.1.0/releasenotes/about.html
183+
184+
In addition to the official source code release, individual contributors have also made release packages available on the Apache CloudStack download page, and available at:
185+
186+
- https://download.cloudstack.org/el/7/
187+
- https://download.cloudstack.org/el/8/
188+
- https://download.cloudstack.org/el/9/
189+
- https://download.cloudstack.org/suse/15/
190+
- https://download.cloudstack.org/ubuntu/dists/
191+
- https://www.shapeblue.com/cloudstack-packages/

‎blog/authors.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,5 +67,5 @@ shwstppr:
6767
pearl:
6868
name: Pearl Dsilva
6969
title: PMC Member
70-
url: http://github.com/Pearl1594
71-
image_url: http://github.com/Pearl1594.png
70+
url: https://github.com/Pearl1594
71+
image_url: https://github.com/Pearl1594.png

0 commit comments

Comments
 (0)