Mailing List Archive: [OSSA 2012-017] Authentication bypass for image deletion (CVE-2012-4573)

OpenStack Security Advisory: 2012-017
CVE: CVE-2012-4573
Date: November 7, 2012
Title: Authentication bypass for image deletion
Impact: High
Reporter: Gabe Westmaas (Rackspace)
Products: Glance
Affects: Essex, Folsom, Grizzly

Description:
Gabe Westmaas from Rackspace reported a vulnerability in Glance
authentication of image deletion requests. Authenticated users may be
able to delete arbitrary, non-protected images from Glance servers. Only
Folsom/Grizzly deployments that expose the v1 API are affected by this
vulnerability. Additionally, Essex deployments that use the
delayed_delete option are also affected.

Fixes:
Grizzly:
https://github.com/openstack/glance/commit/6ab0992e5472ae3f9bef0d2ced41030655d9d2bc
2012.2 (Folsom):
https://github.com/openstack/glance/commit/90bcdc5a89e350a358cf320a03f5afe99795f6f6
2012.1 (Essex): https://review.openstack.org/#/c/15562/

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-4573
https://bugs.launchpad.net/glance/+bug/1065187

Notes:
This fix will be included in the grizzly-1 development milestone and in
a future 2012.2 (Folsom) release.

--
Russell Bryant
OpenStack Vulnerability Management Team

_______________________________________________
OpenStack-announce mailing list
OpenStack-announce@lists.openstack.org
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-announce

On 11/07/2012 05:09 PM, Russell Bryant wrote:
> OpenStack Security Advisory: 2012-017
> CVE: CVE-2012-4573
> Date: November 7, 2012
> Title: Authentication bypass for image deletion
> Impact: High
> Reporter: Gabe Westmaas (Rackspace)
> Products: Glance
> Affects: Essex, Folsom, Grizzly
>
> Description:
> Gabe Westmaas from Rackspace reported a vulnerability in Glance
> authentication of image deletion requests. Authenticated users may be
> able to delete arbitrary, non-protected images from Glance servers. Only
> Folsom/Grizzly deployments that expose the v1 API are affected by this
> vulnerability. Additionally, Essex deployments that use the
> delayed_delete option are also affected.
>
> Fixes:
> Grizzly:
> https://github.com/openstack/glance/commit/6ab0992e5472ae3f9bef0d2ced41030655d9d2bc
> 2012.2 (Folsom):
> https://github.com/openstack/glance/commit/90bcdc5a89e350a358cf320a03f5afe99795f6f6
> 2012.1 (Essex): https://review.openstack.org/#/c/15562/
>
> References:
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-4573
> https://bugs.launchpad.net/glance/+bug/1065187
>
> Notes:
> This fix will be included in the grizzly-1 development milestone and in
> a future 2012.2 (Folsom) release.
>

There have been some important updates that have occurred since the
publication of this advisory:

1) When the advisory was published, the patch for the stable/essex
branch had not been merged. It has now been merged and is *different*
than the original patch. If you pulled the earlier patch, please update
to the final version.

https://github.com/openstack/glance/commit/efd7e75b1f419a52c7103c7840e24af8e5deb29d

2) It was discovered that the patches submitted for stable/folsom and
master (grizzly) did not completely solve the problem. The original
patch only fixed the problem for the v1 API. The problem still existed
for the v2 API. Please see this commit for the additional patch:

bug: https://bugs.launchpad.net/glance/+bug/1076506

stable/folsom:
https://github.com/openstack/glance/commit/fc0ee7623ec59c87ac6fc671e95a9798d6f2e2c3

master:
https://github.com/openstack/glance/commit/b591304b8980d8aca8fa6cda9ea1621aca000c88

--
Russell Bryant
OpenStack Vulnerability Management Team

_______________________________________________
OpenStack-announce mailing list
OpenStack-announce@lists.openstack.org
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-announce