March 2026 - Release-announce - lists.openstack.org

oslotest 6.1.0
by no-reply＠openstack.org 24 Mar '26

24 Mar '26

We are tickled pink to announce the release of: oslotest 6.1.0 The source is available from: https://opendev.org/openstack/oslotest Download the package from: https://pypi.org/project/oslotest For more details, please see below. Changes in oslotest 6.0.0..6.1.0 -------------------------------- 3722be4 ruff: Configure hacking as external linter 74198ba mypy: Disabling warnings for untyped imports b100690 Add typing classifier 3e962ce Add mypy 06c728c typing: Add initial types ae43119 Remove unused dependency 1054c88 Enable logging related ruff checks 84bab7a Delay string interpolations at logging calls d949496 Remove reference to tag framework 840113b ruff: Use more specific name to enable pyupgrade rule Diffstat (except docs and test files) ------------------------------------- .pre-commit-config.yaml | 4 +- README.rst | 11 ++---- oslotest/base.py | 54 +++++++++++++++++-------- oslotest/createfile.py | 18 +++++---- oslotest/log.py | 11 +++--- oslotest/mock_fixture.py | 68 +++++++++++++++++++++++--------- oslotest/modules.py | 20 +++++++--- oslotest/output.py | 11 ++++-- oslotest/py.typed | 0 oslotest/timeout.py | 8 +++- oslotest/tools/config.py | 13 +++--- pyproject.toml | 18 ++++++++- requirements.txt | 1 - tox.ini | 15 ++++++- 18 files changed, 196 insertions(+), 94 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 81463cc..331b2ae 100644 --- a/requirements.txt +++ b/requirements.txt @@ -2 +1,0 @@ fixtures>=3.0.0 # Apache-2.0/BSD -python-subunit>=1.0.0 # Apache-2.0/BSD

1 0

os-api-ref 3.2.0
by no-reply＠openstack.org 24 Mar '26

24 Mar '26

We are excited to announce the release of: os-api-ref 3.2.0 The source is available from: https://opendev.org/openstack/os-api-ref Download the package from: https://tarballs.openstack.org/os-api-ref/ For more details, please see below. 3.2.0 ^^^^^ Upgrade Notes * Support for Python 3.9 has been removed. Now the minimum python version supported is 3.10. Changes in os-api-ref 3.1.0..3.2.0 ---------------------------------- 56792fc ruff: Configure hacking as external linter f10fd60 Replace deprecated nodes.Node.traverse a870746 Add typing 3b882a8 Add ruff 8628eae Defer log arg parsing 0b802f4 Drop workaround for python < 2.7.4 53226f8 Remove reference to tag framework 548bfd6 pre-commit: Bump dependencies 0b14b17 Migrate setup configuration to pyproject.toml f9a9213 Drop Python 3.9 support 6084245 Add support to build api-ref as plain text 7a6d5f2 Use nova bindep file in os-api-ref-nova-src job Diffstat (except docs and test files) ------------------------------------- .pre-commit-config.yaml | 23 +- .zuul.yaml | 1 + README.rst | 28 +- os_api_ref/__init__.py | 352 +++++++++++++-------- os_api_ref/http_codes.py | 120 ++++--- os_api_ref/py.typed | 0 pyproject.toml | 62 ++++ .../notes/remove-py39-4363b4c8cd8655e1.yaml | 5 + requirements.txt | 5 +- setup.cfg | 26 -- setup.py | 13 +- tox.ini | 23 +- 18 files changed, 489 insertions(+), 326 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 4555b93..9d99ca0 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,4 +0,0 @@ -# The order of packages is significant, because pip processes them in the order -# of appearance. Changing the order has an impact on the overall integration -# process, which may cause wedges in the gate later. - @@ -8,0 +5 @@ openstackdocstheme>=2.2.1 # Apache-2.0 +docutils>=0.18.0 # OSI-Approved Open Source, Public Domain

1 0

futurist 3.3.0
by no-reply＠openstack.org 24 Mar '26

24 Mar '26

We are glad to announce the release of: futurist 3.3.0 The source is available from: https://opendev.org/openstack/futurist Download the package from: https://pypi.org/project/futurist For more details, please see below. 3.3.0 ^^^^^ Upgrade Notes * Support for Python 3.9 has been removed. Now the minimum python version supported is 3.10. Changes in futurist 3.2.1..3.3.0 -------------------------------- 0b28c8e Remove MANIFEST.in 78139d7 Add typing 0f25be1 Use "real" *args, **kwargs a8660ca trivial: Remove redundant args, kwargs a458b19 Add ruff c9015a4 Delay string interpolations at logging calls 8e69355 Remove reference to tag framework 86708ef pre-commit: Bump dependencies 85aed58 Migrate setup configuration to pyproject.toml 7464c5b Drop Python 3.9 support Diffstat (except docs and test files) ------------------------------------- .pre-commit-config.yaml | 34 +- MANIFEST.in | 6 - README.rst | 11 +- futurist/__init__.py | 16 +- futurist/_futures.py | 381 ++++++++----- futurist/_green.py | 48 +- futurist/_thread.py | 54 +- futurist/_utils.py | 108 ++-- futurist/periodics.py | 613 ++++++++++++++------- futurist/py.typed | 0 futurist/rejection.py | 21 +- futurist/waiters.py | 197 ++++--- pyproject.toml | 64 +++ .../notes/remove-py39-0673e7740cd5abca.yaml | 5 + releasenotes/source/conf.py | 34 +- setup.cfg | 25 - setup.py | 4 +- tox.ini | 38 +- 22 files changed, 1334 insertions(+), 726 deletions(-)

1 0

sphinx-feature-classification 2.1.0
by no-reply＠openstack.org 24 Mar '26

24 Mar '26

We contentedly announce the release of: sphinx-feature-classification 2.1.0 The source is available from: https://opendev.org/openstack/sphinx-feature-classification Download the package from: https://pypi.org/project/sphinx-feature-classification For more details, please see below. 2.1.0 ^^^^^ Upgrade Notes * Support for Python 3.8 and 3.9 has been removed. Now the minimum Python version supported is 3.10. Changes in sphinx-feature-classification 2.0.0..2.1.0 ----------------------------------------------------- 6a0350a ruff: Configure hacking as external linter 8367e3c Add typing 9dc9ef0 Add ruff 5089218 Migrate setup configuration to pyproject.toml 0969740 Remove translation sections from setup.cfg ebea07b Drop Python 3.8, 3.9 support fc383fa pre-commit: Bump dependencies 68a4a33 add pyproject.toml to support pip 23.1 Diffstat (except docs and test files) ------------------------------------- .pre-commit-config.yaml | 39 ++-- babel.cfg | 2 - pyproject.toml | 65 ++++++ .../notes/remove-py38-py39-4e8cef273cc83d6c.yaml | 5 + releasenotes/source/conf.py | 5 +- requirements.txt | 4 - setup.cfg | 39 ---- setup.py | 4 +- sphinx_feature_classification/__init__.py | 5 +- sphinx_feature_classification/py.typed | 0 sphinx_feature_classification/support_matrix.py | 225 +++++++++++++-------- test-requirements.txt | 2 - tox.ini | 38 ++-- 16 files changed, 293 insertions(+), 211 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 1532602..7b839ca 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,4 +0,0 @@ -# The order of packages is significant, because pip processes them in the order -# of appearance. Changing the order has an impact on the overall integration -# process, which may cause wedges in the gate later. - diff --git a/test-requirements.txt b/test-requirements.txt index 6a75259..40c336c 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -1 +0,0 @@ -hacking>=3.0,<3.1.0 # Apache-2.0 @@ -6 +4,0 @@ testtools>=1.4.0 # MIT -pre-commit>=2.6.0 # MIT

1 0

debtcollector 3.1.0
by no-reply＠openstack.org 24 Mar '26

24 Mar '26

We are overjoyed to announce the release of: debtcollector 3.1.0 The source is available from: https://opendev.org/openstack/debtcollector Download the package from: https://pypi.org/project/debtcollector For more details, please see below. 3.1.0 ^^^^^ Upgrade Notes * Support for Python 3.8 has been removed. Now the minimum python version supported is 3.9 . * Support for Python 3.9 has been removed. Now the minimum python version supported is 3.10. Changes in debtcollector 3.0.0..3.1.0 ------------------------------------- 0dc9ffc ruff: Configure hacking as external linter 2f68955 Bump wrapt to 2.1.0 7abbf7a Add typing information 775fa84 Subclass removed_property from property 259bb57 Bump minimum version of wrapt 42d5591 Integrate ruff, ruff-format 14881ea Remove reference to tag framework fc2c8ae Enable doc8 check for all .rst files 36da9b2 Bump pyupgrade target to 3.10+ 90754a0 pre-commit: Bump dependencies eee60db Migrate setup configuration to pyproject.toml a6fcccd Drop Python 3.9 support 09698e9 add pyproject.toml to support pip 23.1 e102e4d Drop explicit dependency on python-subunit 395e8c5 Drop redundant injection of VIRTUAL_ENV cc8aa27 Drop fallback for Python < 3.8 a3c5805 Add note about requirements lower bounds f49005b Remove Python 3.8 support 60922c8 Use pre-commit hook to run doc8 116055a Run pyupgrade to clean up Python 2 syntaxes 6f912c9 pre-commit: Bump versions d913e61 Declare Python 3.12 support 90480e3 Remove old excludes e823e9d reno: Update master for unmaintained/victoria Diffstat (except docs and test files) ------------------------------------- .pre-commit-config.yaml | 42 +-- README.rst | 30 +- debtcollector/__init__.py | 36 +- debtcollector/_utils.py | 69 +++- debtcollector/fixtures/disable.py | 2 +- debtcollector/moves.py | 201 ++++++---- debtcollector/py.typed | 0 debtcollector/removals.py | 403 ++++++++++++++------- debtcollector/renames.py | 39 +- debtcollector/updating.py | 51 ++- pyproject.toml | 62 ++++ .../notes/remove-py38-301fc55249d7333e.yaml | 5 + .../notes/remove-py39-79d2d42990b42fd8.yaml | 5 + releasenotes/source/conf.py | 36 +- releasenotes/source/victoria.rst | 2 +- requirements.txt | 6 +- setup.cfg | 25 -- setup.py | 4 +- test-requirements.txt | 11 +- tox.ini | 62 ++-- 24 files changed, 773 insertions(+), 410 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 470ffe9..47b4034 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1 +1,5 @@ -wrapt>=1.7.0 # BSD License +# Requirements lower bounds listed here are our best effort to keep them up to +# date but we do not test them so no guarantee of having them all correct. If +# you find any incorrect lower bounds, let us know or propose a fix. + +wrapt>=2.1.0 # BSD License diff --git a/test-requirements.txt b/test-requirements.txt index a594c3a..62c1754 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -1,6 +1 @@ -hacking>=6.1.0,<6.2.0 # Apache-2.0 - -coverage!=4.4,>=4.0 # Apache-2.0 -python-subunit>=1.0.0 # Apache-2.0/BSD -sphinx>=2.0.0,!=2.1.0 # BSD -openstackdocstheme>=2.2.1 # Apache-2.0 +coverage>=4.0 # Apache-2.0 @@ -10,4 +4,0 @@ fixtures>=3.0.0 # Apache-2.0/BSD -doc8>=0.8.1 # Apache-2.0 -reno>=3.1.0 # Apache-2.0 - -pre-commit>=2.6.0 # MIT

1 0

automaton 3.4.0
by no-reply＠openstack.org 24 Mar '26

24 Mar '26

We are happy to announce the release of: automaton 3.4.0 The source is available from: https://opendev.org/openstack/automaton Download the package from: https://pypi.org/project/automaton For more details, please see below. 3.4.0 ^^^^^ Upgrade Notes * Support for Python 3.8 and 3.9 has been removed. Now the minimum python version supported is 3.10. Changes in automaton 3.3.0..3.4.0 --------------------------------- fb4d977 ruff: Configure hacking as external linter 7bb45f7 typing: Provide hint for reaction type b73bb3b Add typing d4417df trivial: Remove use of OrderedDict 70e9037 trivial: Rewrap strings 46a3e9e Add ruff a49b103 docs: Remove cruft from conf files 49e7628 Drop workaround for python < 3.10 2197f53 Drop code for Python < 3 afcad4a Bump pyupgrade target to 3.10+ d5861cf tox: Drop basepython 527681c pre-commit: Bump dependencies d235b95 Migrate setup configuration to pyproject.toml c816ae1 Drop Python 3.9 support Diffstat (except docs and test files) ------------------------------------- .pre-commit-config.yaml | 23 +- README.rst | 13 +- automaton/_utils.py | 40 +-- automaton/converters/pydot.py | 74 ++-- automaton/exceptions.py | 2 +- automaton/machines.py | 371 +++++++++++++-------- automaton/py.typed | 0 automaton/runners.py | 61 ++-- pyproject.toml | 67 ++++ .../notes/remove-py39-c95dedb7fe1cd572.yaml | 5 + releasenotes/source/conf.py | 216 +----------- requirements.txt | 5 +- setup.cfg | 24 -- setup.py | 4 +- tox.ini | 32 +- 17 files changed, 571 insertions(+), 538 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index b66a256..a89632c 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,4 +0,0 @@ -# See: https://bugs.launchpad.net/pbr/+bug/1384919 for why this is here... -pbr>=2.0.0 # Apache-2.0 - -# For pretty formatting machines/state tables... @@ -5,0 +2 @@ PrettyTable>=0.7.2 # BSD +typing-extensions>=4.0.0 # PSF-2.0

1 0

glance 29.2.0 (dalmatian)
by no-reply＠openstack.org 23 Mar '26

23 Mar '26

We are amped to announce the release of: glance 29.2.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/glance Download the package from: https://tarballs.openstack.org/glance/ Please report issues through: https://bugs.launchpad.net/glance/+bugs For more details, please see below. 29.2.0 ^^^^^^ Security Issues *************** * Fixed multiple Server-Side Request Forgery (SSRF) vulnerabilities in Glance's image import functionality. These vulnerabilities could allow attackers to bypass URL validation and access internal resources. **web-download Import Method SSRF:** The web-download import method had two SSRF vulnerabilities: *HTTP Redirect Bypass:* The web-download import method did not validate redirect destinations when following HTTP redirects. An attacker could provide an initial URL that passed validation, but redirect to an internal or disallowed resource that would bypass the security checks. This has been fixed by implementing "SafeRedirectHandler" that validates redirect destinations before following them using the same "validate_import_uri()" checks as the initial URL. *IP Address Encoding Bypass:* The web-download import method's URL validation could be bypassed by encoding IP addresses in alternative formats (decimal integer, hexadecimal, octal). For example, "127.0.0.1" could be encoded as "2130706433" (decimal) or "0x7f000001" (hexadecimal) to bypass blacklist checks. This has been fixed by implementing "normalize_hostname()" function that uses Python's "ipaddress" module to validate IP addresses. The "ipaddress" module only accepts standard dotted-decimal notation for IPv4 and standard format for IPv6, automatically rejecting all encoded formats (decimal, hexadecimal, octal). Any attempt to use encoded IP formats is rejected, preventing SSRF bypass attacks. **glance-download Import Method SSRF:** The glance-download import method had redirect validation bypass vulnerabilities in two steps of the import flow: *Image Data Download:* When downloading image data from a remote Glance endpoint, redirects were not validated, allowing attackers to redirect to internal services. *Metadata Fetch:* When fetching image metadata from a remote Glance endpoint, redirects were not validated, allowing attackers to redirect to internal services. Both steps have been fixed by using "SafeRedirectHandler" to validate redirect destinations before following them. **OVF Processing SSRF:** The OVF processing functionality had a critical SSRF vulnerability with zero protection - no URI validation, no redirect validation, and no IP normalization. The code directly called "urllib.request.urlopen(uri)" without any validation checks. This has been fixed by adding URI validation using "validate_import_uri()" and redirect validation using "SafeRedirectHandler". **Affected Components:** * "glance.common.scripts.utils.get_image_data_iter()" * "glance.common.utils.validate_import_uri()" * "glance.async_.flows._internal_plugins.glance_download._DownloadG lanceImage.execute()" * "glance.async_.flows.api_image_import._ImportMetadata.execute()" * "glance.async_.flows.ovf_process._OVF_Process._get_ova_iter_objec ts()" **Impact:** * Severity: High (web-download, glance-download), Critical (OVF processing) * Affected Versions: All versions prior to this fix * Workaround: Administrators can temporarily disable affected import methods by removing them from the "enabled_import_methods" configuration option Bugs #2138602 (https://bugs.launchpad.net/glance/+bug/2138602) #2138672 (https://bugs.launchpad.net/glance/+bug/2138672) #2138675 (https://bugs.launchpad.net/glance/+bug/2138675) Bug Fixes ********* * Bug 2138602: Fixed SSRF vulnerability in web-download import method via HTTP redirect bypass and IP address encoding bypass. Added redirect validation using "SafeRedirectHandler" and IP address validation using Python's "ipaddress" module to reject encoded IP formats and prevent bypass attacks. Bug 2138672: Fixed SSRF vulnerability in glance-download import method via HTTP redirect bypass. Added redirect validation for both image data download and metadata fetch operations. Bug 2138675: Fixed SSRF vulnerability in OVF processing functionality which lacked URI validation. Added URI validation and redirect validation to prevent SSRF attacks when processing OVA files. Changes in glance 29.1.0..29.2.0 -------------------------------- 76b1f02e5 Fix SSRF vulnerabilities in image import API 3c898c428 Fix inaccurate usage reporting when delayed_delete is enabled Diffstat (except docs and test files) ------------------------------------- .../flows/_internal_plugins/glance_download.py | 5 +- glance/async_/flows/api_image_import.py | 4 +- glance/async_/flows/ovf_process.py | 12 +- glance/common/scripts/utils.py | 16 +- glance/common/utils.py | 69 ++++++- glance/db/sqlalchemy/api.py | 12 +- .../unit/async_/flows/test_api_image_import.py | 88 ++++++++- .../unit/async_/flows/test_glance_download.py | 101 +++++++++- .../unit/common/scripts/test_scripts_utils.py | 109 +++++++++++ .../notes/bug-2138602-5720ad2e501b9e57.yaml | 95 +++++++++ tox.ini | 9 +- 15 files changed, 960 insertions(+), 23 deletions(-)

1 0

glance 31.1.0 (flamingo)
by no-reply＠openstack.org 23 Mar '26

23 Mar '26

We are excited to announce the release of: glance 31.1.0 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/glance Download the package from: https://tarballs.openstack.org/glance/ Please report issues through: https://bugs.launchpad.net/glance/+bugs For more details, please see below. 31.1.0 ^^^^^^ Security Issues *************** * Fixed multiple Server-Side Request Forgery (SSRF) vulnerabilities in Glance's image import functionality. These vulnerabilities could allow attackers to bypass URL validation and access internal resources. **web-download Import Method SSRF:** The web-download import method had two SSRF vulnerabilities: *HTTP Redirect Bypass:* The web-download import method did not validate redirect destinations when following HTTP redirects. An attacker could provide an initial URL that passed validation, but redirect to an internal or disallowed resource that would bypass the security checks. This has been fixed by implementing "SafeRedirectHandler" that validates redirect destinations before following them using the same "validate_import_uri()" checks as the initial URL. *IP Address Encoding Bypass:* The web-download import method's URL validation could be bypassed by encoding IP addresses in alternative formats (decimal integer, hexadecimal, octal). For example, "127.0.0.1" could be encoded as "2130706433" (decimal) or "0x7f000001" (hexadecimal) to bypass blacklist checks. This has been fixed by implementing "normalize_hostname()" function that uses Python's "ipaddress" module to validate IP addresses. The "ipaddress" module only accepts standard dotted-decimal notation for IPv4 and standard format for IPv6, automatically rejecting all encoded formats (decimal, hexadecimal, octal). Any attempt to use encoded IP formats is rejected, preventing SSRF bypass attacks. **glance-download Import Method SSRF:** The glance-download import method had redirect validation bypass vulnerabilities in two steps of the import flow: *Image Data Download:* When downloading image data from a remote Glance endpoint, redirects were not validated, allowing attackers to redirect to internal services. *Metadata Fetch:* When fetching image metadata from a remote Glance endpoint, redirects were not validated, allowing attackers to redirect to internal services. Both steps have been fixed by using "SafeRedirectHandler" to validate redirect destinations before following them. **OVF Processing SSRF:** The OVF processing functionality had a critical SSRF vulnerability with zero protection - no URI validation, no redirect validation, and no IP normalization. The code directly called "urllib.request.urlopen(uri)" without any validation checks. This has been fixed by adding URI validation using "validate_import_uri()" and redirect validation using "SafeRedirectHandler". **Affected Components:** * "glance.common.scripts.utils.get_image_data_iter()" * "glance.common.utils.validate_import_uri()" * "glance.async_.flows._internal_plugins.glance_download._DownloadG lanceImage.execute()" * "glance.async_.flows.api_image_import._ImportMetadata.execute()" * "glance.async_.flows.ovf_process._OVF_Process._get_ova_iter_objec ts()" **Impact:** * Severity: High (web-download, glance-download), Critical (OVF processing) * Affected Versions: All versions prior to this fix * Workaround: Administrators can temporarily disable affected import methods by removing them from the "enabled_import_methods" configuration option Bugs #2138602 (https://bugs.launchpad.net/glance/+bug/2138602) #2138672 (https://bugs.launchpad.net/glance/+bug/2138672) #2138675 (https://bugs.launchpad.net/glance/+bug/2138675) Bug Fixes ********* * Bug 2127798: Automatic S3 credential update when EC2 credentials are rotated Glance now automatically updates S3 image location URLs when EC2 credentials are rotated in Keystone. Previously, images with S3 locations would become inaccessible after credential rotation, requiring manual intervention to update location metadata. This fix ensures seamless credential rotation without breaking image access. (https://bugs.launchpad.net/glance/+bug/2127798) * Bug 2138602: Fixed SSRF vulnerability in web-download import method via HTTP redirect bypass and IP address encoding bypass. Added redirect validation using "SafeRedirectHandler" and IP address validation using Python's "ipaddress" module to reject encoded IP formats and prevent bypass attacks. Bug 2138672: Fixed SSRF vulnerability in glance-download import method via HTTP redirect bypass. Added redirect validation for both image data download and metadata fetch operations. Bug 2138675: Fixed SSRF vulnerability in OVF processing functionality which lacked URI validation. Added URI validation and redirect validation to prevent SSRF attacks when processing OVA files. Changes in glance 31.0.0..31.1.0 -------------------------------- fdfb958b6 Fix SSRF vulnerabilities in image import API 435a5dd2a Add glance/wsgi/__init__.py 0489ff393 Fix FileNotFoundError when registering task operations 8ea9ba973 s3: Do not log access keys 23b2d3bf4 [docs] Add s3 upgrade scenarios ac5505179 Lazy update S3 URL on credential rotation 2ebeab5fc Update TOX_CONSTRAINTS_FILE for stable/2025.2 6dc9e3325 Update .gitreview for stable/2025.2 Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + .../flows/_internal_plugins/glance_download.py | 5 +- glance/async_/flows/api_image_import.py | 4 +- glance/async_/flows/ovf_process.py | 12 +- glance/common/scripts/utils.py | 16 +- glance/common/store_utils.py | 108 ++++ glance/common/utils.py | 69 +- glance/location.py | 30 + glance/task_cancellation_tracker.py | 6 + .../unit/async_/flows/test_api_image_import.py | 88 ++- .../unit/async_/flows/test_glance_download.py | 101 ++- .../unit/common/scripts/test_scripts_utils.py | 109 ++++ glance/wsgi/__init__.py | 0 .../notes/bug-2127798-ff4ecc0c566093da.yaml | 12 + .../notes/bug-2138602-5720ad2e501b9e57.yaml | 95 +++ tox.ini | 2 +- 24 files changed, 1750 insertions(+), 25 deletions(-)

1 0

glance 30.2.0 (epoxy)
by no-reply＠openstack.org 23 Mar '26

23 Mar '26

We are amped to announce the release of: glance 30.2.0 This release is part of the epoxy release series. The source is available from: https://opendev.org/openstack/glance Download the package from: https://tarballs.openstack.org/glance/ Please report issues through: https://bugs.launchpad.net/glance/+bugs For more details, please see below. 30.2.0 ^^^^^^ Security Issues *************** * Fixed multiple Server-Side Request Forgery (SSRF) vulnerabilities in Glance's image import functionality. These vulnerabilities could allow attackers to bypass URL validation and access internal resources. **web-download Import Method SSRF:** The web-download import method had two SSRF vulnerabilities: *HTTP Redirect Bypass:* The web-download import method did not validate redirect destinations when following HTTP redirects. An attacker could provide an initial URL that passed validation, but redirect to an internal or disallowed resource that would bypass the security checks. This has been fixed by implementing "SafeRedirectHandler" that validates redirect destinations before following them using the same "validate_import_uri()" checks as the initial URL. *IP Address Encoding Bypass:* The web-download import method's URL validation could be bypassed by encoding IP addresses in alternative formats (decimal integer, hexadecimal, octal). For example, "127.0.0.1" could be encoded as "2130706433" (decimal) or "0x7f000001" (hexadecimal) to bypass blacklist checks. This has been fixed by implementing "normalize_hostname()" function that uses Python's "ipaddress" module to validate IP addresses. The "ipaddress" module only accepts standard dotted-decimal notation for IPv4 and standard format for IPv6, automatically rejecting all encoded formats (decimal, hexadecimal, octal). Any attempt to use encoded IP formats is rejected, preventing SSRF bypass attacks. **glance-download Import Method SSRF:** The glance-download import method had redirect validation bypass vulnerabilities in two steps of the import flow: *Image Data Download:* When downloading image data from a remote Glance endpoint, redirects were not validated, allowing attackers to redirect to internal services. *Metadata Fetch:* When fetching image metadata from a remote Glance endpoint, redirects were not validated, allowing attackers to redirect to internal services. Both steps have been fixed by using "SafeRedirectHandler" to validate redirect destinations before following them. **OVF Processing SSRF:** The OVF processing functionality had a critical SSRF vulnerability with zero protection - no URI validation, no redirect validation, and no IP normalization. The code directly called "urllib.request.urlopen(uri)" without any validation checks. This has been fixed by adding URI validation using "validate_import_uri()" and redirect validation using "SafeRedirectHandler". **Affected Components:** * "glance.common.scripts.utils.get_image_data_iter()" * "glance.common.utils.validate_import_uri()" * "glance.async_.flows._internal_plugins.glance_download._DownloadG lanceImage.execute()" * "glance.async_.flows.api_image_import._ImportMetadata.execute()" * "glance.async_.flows.ovf_process._OVF_Process._get_ova_iter_objec ts()" **Impact:** * Severity: High (web-download, glance-download), Critical (OVF processing) * Affected Versions: All versions prior to this fix * Workaround: Administrators can temporarily disable affected import methods by removing them from the "enabled_import_methods" configuration option Bugs #2138602 (https://bugs.launchpad.net/glance/+bug/2138602) #2138672 (https://bugs.launchpad.net/glance/+bug/2138672) #2138675 (https://bugs.launchpad.net/glance/+bug/2138675) Bug Fixes ********* * Bug 2138602: Fixed SSRF vulnerability in web-download import method via HTTP redirect bypass and IP address encoding bypass. Added redirect validation using "SafeRedirectHandler" and IP address validation using Python's "ipaddress" module to reject encoded IP formats and prevent bypass attacks. Bug 2138672: Fixed SSRF vulnerability in glance-download import method via HTTP redirect bypass. Added redirect validation for both image data download and metadata fetch operations. Bug 2138675: Fixed SSRF vulnerability in OVF processing functionality which lacked URI validation. Added URI validation and redirect validation to prevent SSRF attacks when processing OVA files. Changes in glance 30.1.0..30.2.0 -------------------------------- bb0d59fff Fix SSRF vulnerabilities in image import API d88f696b7 [stable-only] fix stable/2025.1 gate jobs 9b0af5631 Add glance/wsgi/__init__.py Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 9 +- .../flows/_internal_plugins/glance_download.py | 5 +- glance/async_/flows/api_image_import.py | 4 +- glance/async_/flows/ovf_process.py | 12 +- glance/common/scripts/utils.py | 16 +- glance/common/utils.py | 69 +++++++- .../unit/async_/flows/test_api_image_import.py | 88 +++++++++- .../unit/async_/flows/test_glance_download.py | 101 +++++++++++- .../unit/common/scripts/test_scripts_utils.py | 109 +++++++++++++ glance/wsgi/__init__.py | 0 .../notes/bug-2138602-5720ad2e501b9e57.yaml | 95 +++++++++++ tox.ini | 13 +- 17 files changed, 908 insertions(+), 23 deletions(-)

1 0

glance 32.0.0.0rc2 (gazpacho)
by no-reply＠openstack.org 23 Mar '26

23 Mar '26

Hello everyone, A new release candidate for glance for the end of the Gazpacho cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/glance/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Gazpacho release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/gazpacho release branch at: https://opendev.org/openstack/glance/src/branch/stable/gazpacho Release notes for glance can be found at: https://docs.openstack.org/releasenotes/glance/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/glance/+bugs and tag it *gazpacho-rc-potential* to bring it to the glance release crew's attention.

1 0