** Changed in: openstack-ansible/icehouse
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Glance.
https://bugs.launchpad.net/bugs/1400966
Title:
[OSSA-2014-041] Glance allows users to download and delete any file in
glance-api server (CVE-2014-9493)
Status in OpenStack Image Registry and Delivery Service (Glance):
Fix Released
Status in Glance icehouse series:
Fix Committed
Status in Glance juno series:
Fix Released
Status in Ansible playbooks for deploying OpenStack:
Fix Committed
Status in openstack-ansible icehouse series:
Fix Released
Status in openstack-ansible juno series:
Fix Released
Status in OpenStack Security Advisories:
Fix Released
Bug description:
Updating image-location by update images API users can download any file for
which glance-api has read permission.
And the file for which glance-api has write permission will be deleted when
users delete the image.
For example:
When users specify '/etc/passwd' as locations value of an image user can get
the file by image download.
When locations of an image is set with 'file:///path/to/glance-
api.conf' the conf will be deleted when users delete the image.
How to recreate the bug:
download files:
- set show_multiple_locations True in glance-api.conf
- create a new image
- set locations of the image's property a path you want to get such as
file:///etc/passwd.
- download the image
delete files:
- set show_multiple_locations True in glance-api.conf
- create a new image
- set locations of the image's property a path you want to delete such as
file:///path/to/glance-api.conf
- delete the image
I found this bug in 2014.2 (742c898956d655affa7351505c8a3a5c72881eae).
What a big A RE RE!!
To manage notifications about this bug go to:
https://bugs.launchpad.net/glance/+bug/1400966/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
