Thierry Carrez (thierry) reports:
Title: Backend credentials leak in Glance v1 API
Reporter: Stuart McLaren (HP)
Products: Glance
Affects: All versions
Description:
Stuart McLaren from HP reported a vulnerability in the information
potentially returned to the user in Glance v1 API. If an authenticated
user requests, through the v1 API, an image that is already cached, the
headers returned may disclose the Glance operator's backend credentials
for that endpoint. Only setups accepting the Glance v1 API and using
either the single-tenant Swift store or S3 store are affected.
Proposed patches:
See attached patches. Unless a flaw is discovered in them, these patches
will be merged to Glance master (Grizzly), stable/folsom, and
stable/essex branches on the public disclosure date.
Comment 10Murray McAllister
2013-03-27 01:54:14 UTC
Acknowledgements:
Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Stuart McLaren (HP) as the original reporter.