Bug 872302 (CVE-2012-4573) - CVE-2012-4573 OpenStack: Glance Authentication bypass for image deletion
Summary: CVE-2012-4573 OpenStack: Glance Authentication bypass for image deletion
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2012-4573
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 872303 874567 874568 875219
Blocks: 836072 873487
TreeView+ depends on / blocked
 
Reported: 2012-11-01 18:35 UTC by Kurt Seifried
Modified: 2023-05-12 23:15 UTC (History)
17 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-12-11 07:57:23 UTC
Embargoed:


Attachments (Terms of Use)
openstack-essex-glance-CVE-2012-4573.patch (813 bytes, patch)
2012-11-01 19:32 UTC, Kurt Seifried
no flags Details | Diff
openstack-folsom-grizzly-glance-CVE-2012-4573.patch (1.73 KB, patch)
2012-11-01 19:33 UTC, Kurt Seifried
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Launchpad 1065187 0 None None None 2012-11-09 11:21:24 UTC
Launchpad 1076506 0 None None None 2012-11-09 11:23:12 UTC
Red Hat Product Errata RHSA-2012:1558 0 normal SHIPPED_LIVE Low: openstack-glance security update 2012-12-11 02:00:25 UTC

Description Kurt Seifried 2012-11-01 18:35:21 UTC
Thierry Carrez (thierry) has released information reported by Gabe Westmaas (Rackspace):

Title: Authentication bypass for image deletion
Reporter: Gabe Westmaas (Rackspace)
Products: Glance
Affects: Essex, Folsom, Grizzly

Description:
Gabe Westmaas from Rackspace reported a vulnerability in Glance
authentication of image deletion requests. Authenticated users may be
able to delete arbitrary, non-protected images from Glance servers. Only
Folsom/Grizzly deployments that expose the v1 API are affected by this
vulnerability. Additionally, Essex deployments that use the
delayed_delete option are also affected.

Comment 1 Kurt Seifried 2012-11-01 19:32:46 UTC
Created attachment 636814 [details]
openstack-essex-glance-CVE-2012-4573.patch

Comment 2 Kurt Seifried 2012-11-01 19:33:04 UTC
Created attachment 636815 [details]
openstack-folsom-grizzly-glance-CVE-2012-4573.patch

Comment 4 Jan Lieskovsky 2012-11-08 13:16:33 UTC
Created openstack-glance tracking bugs for this issue

Affects: fedora-all [bug 874567]
Affects: epel-6 [bug 874568]

Comment 5 Kurt Seifried 2012-11-09 04:43:13 UTC
On 11/07/2012 05:10 PM, Russell Bryant wrote:
> OpenStack Security Advisory: 2012-017
> CVE: CVE-2012-4573
> Date: November 7, 2012
> Title: Authentication bypass for image deletion
> Impact: High
> Reporter: Gabe Westmaas (Rackspace)
> Products: Glance
> Affects: Essex, Folsom, Grizzly
>
> Description:
> Gabe Westmaas from Rackspace reported a vulnerability in Glance
> authentication of image deletion requests. Authenticated users may be
> able to delete arbitrary, non-protected images from Glance servers. Only
> Folsom/Grizzly deployments that expose the v1 API are affected by this
> vulnerability. Additionally, Essex deployments that use the
> delayed_delete option are also affected.
>
> Fixes:
> Grizzly:
> https://github.com/openstack/glance/commit/6ab0992e5472ae3f9bef0d2ced41030655d9d2bc
> 2012.2 (Folsom):
> https://github.com/openstack/glance/commit/90bcdc5a89e350a358cf320a03f5afe99795f6f6
> 2012.1 (Essex): https://review.openstack.org/#/c/15562/
>
> References:
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-4573
> https://bugs.launchpad.net/glance/+bug/1065187
>
> Notes:
> This fix will be included in the grizzly-1 development milestone and in
> a future 2012.2 (Folsom) release.
>

There have been some important updates that have occurred since the
publication of this advisory:

1) When the advisory was published, the patch for the stable/essex
branch had not been merged.  It has now been merged and is *different*
than the original patch.  If you pulled the earlier patch, please update
to the final version.

https://github.com/openstack/glance/commit/efd7e75b1f419a52c7103c7840e24af8e5deb29d

2) It was discovered that the patches submitted for stable/folsom and
master (grizzly) did not completely solve the problem.  The original
patch only fixed the problem for the v1 API.  The problem still existed
for the v2 API.  Please see this commit for the additional patch:

bug: https://bugs.launchpad.net/glance/+bug/1076506

stable/folsom:
https://github.com/openstack/glance/commit/fc0ee7623ec59c87ac6fc671e95a9798d6f2e2c3

master:
https://github.com/openstack/glance/commit/b591304b8980d8aca8fa6cda9ea1621aca000c88

-- Russell Bryant OpenStack Vulnerability Management Team

Comment 6 Vincent Danen 2012-11-09 18:25:58 UTC
This was assigned CVE-2012-5482 (the second fix noted above):

http://seclists.org/oss-sec/2012/q4/241

Comment 7 Fedora Update System 2012-11-17 19:50:01 UTC
python-keystoneclient-0.1.3.27-1.el6, python-glanceclient-0.5.1-1.el6, python-websockify-0.2.0-1.el6, novnc-0.4-2.el6, python-prettytable-0.6.1-1.el6, openstack-quantum-2012.2-2.el6, python-quantumclient-2.1.1-0.el6, python-cinderclient-0.2.26-1.el6, python-novaclient-2.9.0-1.el6, python-django-openstack-auth-1.0.2-3.el6, openstack-nova-2012.2-2.el6, openstack-cinder-2012.2-3.el6, openstack-utils-2012.2-6.el6, openstack-glance-2012.2-3.el6, python-django-horizon-2012.2-4.el6, openstack-keystone-2012.2-5.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Kurt Seifried 2012-12-03 20:48:14 UTC
Red Hat includes the full fix for CVE-2012-4573 in OpenStack Glance and as such Red Hat OpenStack is not vulnerable to CVE-2012-5482.

Comment 9 Kurt Seifried 2012-12-10 17:43:43 UTC
Acknowledgements:

Red Hat would like to thank the OpenStack project for reporting this
issue. Upstream acknowledges Gabe Westmaas as the original reporter of
CVE-2012-4573.

Comment 10 errata-xmlrpc 2012-12-10 21:02:11 UTC
This issue has been addressed in following products:

  OpenStack Essex for RHEL 6

Via RHSA-2012:1558 https://rhn.redhat.com/errata/RHSA-2012-1558.html


Note You need to log in before you can comment on or make changes to this bug.