Your message dated Wed, 12 Aug 2026 12:18:41 +0000
with message-id <[email protected]>
and subject line Bug#1144212: fixed in glance 2:32.0.0-3
has caused the Debian Bug report #1144212,
regarding [OSSN-0105] OpenStack Glance legacy Tasks import bypasses image
import URI filtering
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1144212: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144212
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: glance
Version: 2:30.0.0-3+deb13u2
Severity: important
Tags: patch security
X-Debbugs-Cc: Debian Security Team <[email protected]>
As per upstream announce at:
https://wiki.openstack.org/wiki/OSSN/OSSN-0105
Glance legacy Tasks import bypasses image import URI filtering Summary
The deprecated Glance /v2/tasks API accepts type=import tasks that bypass
import_filtering_opts, allowing an admin to fetch internal URLs from the
Glance service network (SSRF). The tasks API has been admin-only since Xena
and deprecated for several releases.
Affected Services / Software:
glance: >=30.0.0 <30.3.0, >=31.0.0 <31.1.1, ==32.0.0
Discussion:
The legacy tasks import path uses a permissive URI validator that only checks
for http:// or https:// prefixes, bypassing the host and port restrictions
enforced by the modern web-download import.
Recommended Actions:
Disable the legacy tasks API via policy if you are not using it. Otherwise,
upgrade Glance to a version containing the fix.
Patches:
The following reviews contain the fix for this issue:
2026.2/hibiscus (development):
https://review.opendev.org/c/openstack/glance/+/993588
2026.1/gazpacho: https://review.opendev.org/c/openstack/glance/+/994466
2025.2/flamingo: https://review.opendev.org/c/openstack/glance/+/994592
2025.1/epoxy: https://review.opendev.org/c/openstack/glance/+/1000061
Credits:
Tim Shephard, roiai.ca
Contacts / References
Authors: Goutham Pacha Ravi, Red Hat
This OSSN: https://wiki.openstack.org/wiki/OSSN/OSSN-0105
Original Launchpad bug: https://bugs.launchpad.net/glance/+bug/2152110
Mailing List : [security-sig] tag on [email protected]
OpenStack Security : https://security.openstack.org/
CVE: none
--- End Message ---
--- Begin Message ---
Source: glance
Source-Version: 2:32.0.0-3
Done: Thomas Goirand <[email protected]>
We believe that the bug you reported is fixed in the latest version of
glance, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <[email protected]> (supplier of updated glance package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 12 Aug 2026 13:43:14 +0200
Source: glance
Architecture: source
Version: 2:32.0.0-3
Distribution: unstable
Urgency: high
Maintainer: Debian OpenStack <[email protected]>
Changed-By: Thomas Goirand <[email protected]>
Closes: 1144212
Changes:
glance (2:32.0.0-3) unstable; urgency=high
.
* OSSN-0105: legacy Tasks import bypasses image import URI filtering.
Applied upstream patch: "Apply import URI filtering to legacy import
tasks" (Closes: #1144212).
Checksums-Sha1:
4757507c6efbe6ca6a12c7ea9d16f87b023905c8 3707 glance_32.0.0-3.dsc
7ce869008f72c8397a34a5eaad3ea7ba165fe21f 23548 glance_32.0.0-3.debian.tar.xz
2a07eddc55303a81e550a03b2bb18151ccf140ff 18713 glance_32.0.0-3_amd64.buildinfo
Checksums-Sha256:
1ee42e9c0b6e5ab3410b12a7bd83f4d83488ee31e7483c00e54d3a3e3199be85 3707
glance_32.0.0-3.dsc
84863085443598274b5ebe0b4ee6a1033a31f685563bcb472d97e82a91930131 23548
glance_32.0.0-3.debian.tar.xz
044f6b1e2523ff3bb5b26a726bde2b1975cf34d831e3b1707d81c421519fae1d 18713
glance_32.0.0-3_amd64.buildinfo
Files:
002e109bdbc4564d50641c5dcb7d7a8b 3707 net optional glance_32.0.0-3.dsc
de15c698317af23ff59bb4603cdfc186 23548 net optional
glance_32.0.0-3.debian.tar.xz
bf395a3acc7143bb2681cba973ad5132 18713 net optional
glance_32.0.0-3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmp8YDkACgkQ1BatFaxr
Q/49/w//alNRGYjWdATm6mYiXhOxGeUY0tg3hKu1eVS/iXNzg1UxGCT2z5XBIMPb
tnxr62+y+k+XD95TDgqn4JOpgWGxhDTGJhgnW930WOk+Gd33cNC8Qyffi+3JHpLb
WGT61iDXZN1KOcqQY1nz0LNXQOjhB1OS5fyBgDZOs3lTgHeebtqSUe1QIvOtyBQL
5RCeiUDZMsHqlinoTjLU14QB/ZA8+qRYS4x2faY/yTbuymi7kKLTc3jFRODj8VFe
828P/3EEVKJS5CvmhF/RyMBkyYwaOEqX97MyA35IhwhhePtGqznBBpqSkxcYIXzY
fuO09zgB6x52liXCT5P4hxlotdOQ5VKEaTzYkdudcf1b3XUIge8rCoAuH8WucyJZ
gdid2qE2d8ArU6NG+vxXcFDR0a97EGiAQOttPq5s1/gCi9/ygx3fftzyUE75kkq5
C/b66GKEIfqaoTl/kRjgGkyWojUWBQO+09x8bJNcswgHaWa+2L4XWfKz46NgqpNO
0a3qXGBKCGkBnYVtiK1MeA6h3zPQfoFEFewxJwYUIkGkL0Eq5G+FJnl5xamhKa0G
433LfJX/IFyS7GL/cS6c5UsTy+WKndXuyR6Ik2GlvGWSkWa7eP9u9tt0lyvaDUxp
X6HKWb4eRUPlH4QIP8v2O1nhTfKK6z5iwDMzuygnDS53QkvlED8=
=xKct
-----END PGP SIGNATURE-----
pgpVwOLUhPdY8.pgp
Description: PGP signature
--- End Message ---
