On 11/07/2012 05:09 PM, Russell Bryant wrote:
OpenStack Security Advisory: 2012-017 CVE: CVE-2012-4573 Date: November 7, 2012 Title: Authentication bypass for image deletion Impact: High Reporter: Gabe Westmaas (Rackspace) Products: Glance Affects: Essex, Folsom, Grizzly
Description: Gabe Westmaas from Rackspace reported a vulnerability in Glance authentication of image deletion requests. Authenticated users may be able to delete arbitrary, non-protected images from Glance servers. Only Folsom/Grizzly deployments that expose the v1 API are affected by this vulnerability. Additionally, Essex deployments that use the delayed_delete option are also affected.
Fixes: Grizzly: https://github.com/openstack/glance/commit/6ab0992e5472ae3f9bef0d2ced4103065... 2012.2 (Folsom): https://github.com/openstack/glance/commit/90bcdc5a89e350a358cf320a03f5afe99... 2012.1 (Essex): https://review.openstack.org/#/c/15562/
References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-4573 https://bugs.launchpad.net/glance/+bug/1065187
Notes: This fix will be included in the grizzly-1 development milestone and in a future 2012.2 (Folsom) release.
There have been some important updates that have occurred since the publication of this advisory: 1) When the advisory was published, the patch for the stable/essex branch had not been merged. It has now been merged and is *different* than the original patch. If you pulled the earlier patch, please update to the final version. https://github.com/openstack/glance/commit/efd7e75b1f419a52c7103c7840e24af8e... 2) It was discovered that the patches submitted for stable/folsom and master (grizzly) did not completely solve the problem. The original patch only fixed the problem for the v1 API. The problem still existed for the v2 API. Please see this commit for the additional patch: bug: https://bugs.launchpad.net/glance/+bug/1076506 stable/folsom: https://github.com/openstack/glance/commit/fc0ee7623ec59c87ac6fc671e95a9798d... master: https://github.com/openstack/glance/commit/b591304b8980d8aca8fa6cda9ea1621ac... -- Russell Bryant OpenStack Vulnerability Management Team