Bug 1302607 (CVE-2016-0757)
| Summary: | CVE-2016-0757 openstack-glance: Glance image status manipulation through locations | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> | ||||||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | |||||||||
| Severity: | low | Docs Contact: | |||||||||
| Priority: | low | ||||||||||
| Version: | unspecified | CC: | abaron, aortega, apevec, ayoung, chrisw, cyril, dallan, eglynn, fpercoco, gkotton, gmollett, hguemar, jjoyce, jschluet, kbasil, lhh, lpeer, markmc, mburns, panbalag, rbryant, sclewis, security-response-team, slinaber, slong, srevivo, tdecacqu, yeylon | ||||||||
| Target Milestone: | --- | Keywords: | Security | ||||||||
| Target Release: | --- | ||||||||||
| Hardware: | All | ||||||||||
| OS: | Linux | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||||
| Doc Text: |
An authorization vulnerability in OpenStack Image service was discovered, which allowed image-status manipulation using locations. By removing the last location of an image, an authenticated user could change the status from 'active' to 'queue'. A malicious tenant could exploit this flaw to silently replace owned image data, regardless of its original creator or visibility settings. Only environments with show_multiple_locations set to true (not default) were affected.
|
Story Points: | --- | ||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2016-03-08 21:42:39 UTC | Type: | --- | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Bug Depends On: | 1303233, 1303234, 1303235, 1303236, 1303237, 1304726, 1304727 | ||||||||||
| Bug Blocks: | 1302609 | ||||||||||
| Attachments: |
|
||||||||||
|
Description
Adam Mariš
2016-01-28 09:13:22 UTC
Acknowledgments: Name: the Openstack project Upstream: Erno Kuvaja (HPE) Created attachment 1119384 [details]
Master/mitaka patch
Created attachment 1119385 [details]
Stable/kilo patch
Created attachment 1119386 [details]
Stable/liberty patch
The proposed fix prevents the removal of the last location of an image so that an active image is always available. This action was previously incorrectly allowed and the fix might break some users who are relying on the false assumption that it would be OK to replace the data of existing image in the special case that the multiple locations has been configured. Taking care of backporting/rebuilding the packages Note that the impact description and note have changed slightly, here are the updated version: Description: Erno Kuvaja from HPE reported a vulnerability in Glance. By removing the last location of an image, an authenticated user may change the image status back to queued and may be able to upload new image data resulting in a broken Glance’s immutability promise. A malicious tenant may exploit this flaw to silently replace image data it owns, regardless of the original creator or the visibility settings. Only setups with show_multiple_locations enabled (not default) are affected. Note: The proposed fix prevents the removal of the last location of an image so that an active image is always available. This action was previously incorrectly allowed and the fix might break some users who are relying on the false assumption that it would be ok to replace the data of existing image in the special case that the multiple locations has been configured. Unfortunately the proposed patch contained a couple of mistakes: The stable/kilo was missing an import and may fail with a NameError exception when trying to log an error. The master/mitaka patch python3 unit tests were not able to validate the new HTTPForbidden exceptions. A new version of those patches are now available here: https://review.openstack.org/#/c/275735/ https://review.openstack.org/#/c/275737/ Created openstack-glance tracking bugs for this issue: Affects: fedora-all [bug 1304727] Public via: http://seclists.org/oss-sec/2016/q1/280 This issue has been addressed in the following products: OpenStack 6 for RHEL 7 Via RHSA-2016:0309 https://rhn.redhat.com/errata/RHSA-2016-0309.html This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 Via RHSA-2016:0352 https://rhn.redhat.com/errata/RHSA-2016-0352.html This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 Via RHSA-2016:0354 https://rhn.redhat.com/errata/RHSA-2016-0354.html This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 Via RHSA-2016:0358 https://rhn.redhat.com/errata/RHSA-2016-0358.html |