Red Hat Bugzilla – Full Text Bug Listing
|Summary:||CVE-2012-4573 OpenStack: Glance Authentication bypass for image deletion|
|Product:||[Other] Security Response||Reporter:||Kurt Seifried <kseifried>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||CLOSED ERRATA||QA Contact:|
|Version:||unspecified||CC:||apevec, apevec, bfilippov, breu, cpelland, d.busby, Jan.van.Eldik, jonathansteffan, jose.castro.leon, markmc, matt_domsch, nsantos, pbrady, p, rbryant, rkukura, security-response-team|
|Fixed In Version:||Doc Type:||Bug Fix|
|Doc Text:||Story Points:||---|
|Last Closed:||2012-12-11 02:57:23 EST||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Bug Depends On:||872303, 874567, 874568, 875219|
|Bug Blocks:||836072, 873487|
Description Kurt Seifried 2012-11-01 14:35:21 EDT
Thierry Carrez (email@example.com) has released information reported by Gabe Westmaas (Rackspace): Title: Authentication bypass for image deletion Reporter: Gabe Westmaas (Rackspace) Products: Glance Affects: Essex, Folsom, Grizzly Description: Gabe Westmaas from Rackspace reported a vulnerability in Glance authentication of image deletion requests. Authenticated users may be able to delete arbitrary, non-protected images from Glance servers. Only Folsom/Grizzly deployments that expose the v1 API are affected by this vulnerability. Additionally, Essex deployments that use the delayed_delete option are also affected.
Comment 1 Kurt Seifried 2012-11-01 15:32:46 EDT
Created attachment 636814 [details] openstack-essex-glance-CVE-2012-4573.patch
Comment 2 Kurt Seifried 2012-11-01 15:33:04 EDT
Created attachment 636815 [details] openstack-folsom-grizzly-glance-CVE-2012-4573.patch
Comment 3 Tomas Hoger 2012-11-08 05:05:17 EST
Comment 4 Jan Lieskovsky 2012-11-08 08:16:33 EST
Created openstack-glance tracking bugs for this issue Affects: fedora-all [bug 874567] Affects: epel-6 [bug 874568]
Comment 5 Kurt Seifried 2012-11-08 23:43:13 EST
On 11/07/2012 05:10 PM, Russell Bryant wrote: > OpenStack Security Advisory: 2012-017 > CVE: CVE-2012-4573 > Date: November 7, 2012 > Title: Authentication bypass for image deletion > Impact: High > Reporter: Gabe Westmaas (Rackspace) > Products: Glance > Affects: Essex, Folsom, Grizzly > > Description: > Gabe Westmaas from Rackspace reported a vulnerability in Glance > authentication of image deletion requests. Authenticated users may be > able to delete arbitrary, non-protected images from Glance servers. Only > Folsom/Grizzly deployments that expose the v1 API are affected by this > vulnerability. Additionally, Essex deployments that use the > delayed_delete option are also affected. > > Fixes: > Grizzly: > https://github.com/openstack/glance/commit/6ab0992e5472ae3f9bef0d2ced41030655d9d2bc > 2012.2 (Folsom): > https://github.com/openstack/glance/commit/90bcdc5a89e350a358cf320a03f5afe99795f6f6 > 2012.1 (Essex): https://review.openstack.org/#/c/15562/ > > References: > http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-4573 > https://bugs.launchpad.net/glance/+bug/1065187 > > Notes: > This fix will be included in the grizzly-1 development milestone and in > a future 2012.2 (Folsom) release. > There have been some important updates that have occurred since the publication of this advisory: 1) When the advisory was published, the patch for the stable/essex branch had not been merged. It has now been merged and is *different* than the original patch. If you pulled the earlier patch, please update to the final version. https://github.com/openstack/glance/commit/efd7e75b1f419a52c7103c7840e24af8e5deb29d 2) It was discovered that the patches submitted for stable/folsom and master (grizzly) did not completely solve the problem. The original patch only fixed the problem for the v1 API. The problem still existed for the v2 API. Please see this commit for the additional patch: bug: https://bugs.launchpad.net/glance/+bug/1076506 stable/folsom: https://github.com/openstack/glance/commit/fc0ee7623ec59c87ac6fc671e95a9798d6f2e2c3 master: https://github.com/openstack/glance/commit/b591304b8980d8aca8fa6cda9ea1621aca000c88 -- Russell Bryant OpenStack Vulnerability Management Team
Comment 6 Vincent Danen 2012-11-09 13:25:58 EST
This was assigned CVE-2012-5482 (the second fix noted above): http://seclists.org/oss-sec/2012/q4/241
Comment 7 Fedora Update System 2012-11-17 14:50:01 EST
python-keystoneclient-0.1.3.27-1.el6, python-glanceclient-0.5.1-1.el6, python-websockify-0.2.0-1.el6, novnc-0.4-2.el6, python-prettytable-0.6.1-1.el6, openstack-quantum-2012.2-2.el6, python-quantumclient-2.1.1-0.el6, python-cinderclient-0.2.26-1.el6, python-novaclient-2.9.0-1.el6, python-django-openstack-auth-1.0.2-3.el6, openstack-nova-2012.2-2.el6, openstack-cinder-2012.2-3.el6, openstack-utils-2012.2-6.el6, openstack-glance-2012.2-3.el6, python-django-horizon-2012.2-4.el6, openstack-keystone-2012.2-5.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
Comment 8 Kurt Seifried 2012-12-03 15:48:14 EST
Red Hat includes the full fix for CVE-2012-4573 in OpenStack Glance and as such Red Hat OpenStack is not vulnerable to CVE-2012-5482.
Comment 9 Kurt Seifried 2012-12-10 12:43:43 EST
Acknowledgements: Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Gabe Westmaas as the original reporter of CVE-2012-4573.