)]}'
{"releasenotes/notes/newton-1-release-065334d464f78fc5.yaml":[{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"30f958cb9149ee6d6f949c3a1a9d5eb17b36938b","unresolved":false,"context_lines":[{"line_number":11,"context_line":"    instead of the data itself has been removed. So, when image"},{"line_number":12,"context_line":"    signing is configured Glance will store two different hash MD5"},{"line_number":13,"context_line":"    and SHA-256. However, only SHA-256 will be used to verify the"},{"line_number":14,"context_line":"    Digital Signature on the image during download, in this case."},{"line_number":15,"context_line":"security:"},{"line_number":16,"context_line":"  - The image signing feature of Glance can be insecure when"},{"line_number":17,"context_line":"    using md5. This has been explained well in bug 1516031,"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"9abb7d3a_193a2f99","line":14,"updated":"2016-06-01 17:52:29.000000000","message":"This is inaccurate.  There is no SHA-256 hash stored with the image now.\n\nA better way to state the upgrade would be:\n\nThe image signature verification feature has been updated to follow the \"sign-the-data\" approach, which uses a signature of the image data directly.   The prior deprecated \"sign-the-hash\" approach, which uses a signature of an MD5 has of the image data, has been removed.","commit_id":"3e3cd2357959c8ed44ada3c5354c16d1956d6ffd"},{"author":{"_account_id":2537,"name":"Nikhil Komawar","email":"nik.komawar@gmail.com","username":"nikhil-komawar"},"change_message_id":"a1c1637ca8175c624ee9285167f03b686e5206f2","unresolved":false,"context_lines":[{"line_number":11,"context_line":"    instead of the data itself has been removed. So, when image"},{"line_number":12,"context_line":"    signing is configured Glance will store two different hash MD5"},{"line_number":13,"context_line":"    and SHA-256. However, only SHA-256 will be used to verify the"},{"line_number":14,"context_line":"    Digital Signature on the image during download, in this case."},{"line_number":15,"context_line":"security:"},{"line_number":16,"context_line":"  - The image signing feature of Glance can be insecure when"},{"line_number":17,"context_line":"    using md5. This has been explained well in bug 1516031,"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"9abb7d3a_dc9ed561","line":14,"in_reply_to":"9abb7d3a_193a2f99","updated":"2016-06-01 18:09:09.000000000","message":"Done","commit_id":"3e3cd2357959c8ed44ada3c5354c16d1956d6ffd"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"30f958cb9149ee6d6f949c3a1a9d5eb17b36938b","unresolved":false,"context_lines":[{"line_number":16,"context_line":"  - The image signing feature of Glance can be insecure when"},{"line_number":17,"context_line":"    using md5. This has been explained well in bug 1516031,"},{"line_number":18,"context_line":"    deprecation of this usage was done in Mitaka. In newton-1,"},{"line_number":19,"context_line":"    this \u0027sign-the-hash\u0027 appraoch has been removed."},{"line_number":20,"context_line":"    Related CVE-2015-8234."},{"line_number":21,"context_line":"fixes:"},{"line_number":22,"context_line":"  - |"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"9abb7d3a_d9754732","line":19,"updated":"2016-06-01 17:52:29.000000000","message":"A better way to state this would be:\n\nThe initial implementation of the image signature verification feature in Glance was insecure, because it relied on an MD5 hash of the image data.  More details can be found in bug 1516031.  This \u0027sign-the-hash\u0027 approach was deprecated in Mitaka, and removed in newton-1.","commit_id":"3e3cd2357959c8ed44ada3c5354c16d1956d6ffd"},{"author":{"_account_id":2537,"name":"Nikhil Komawar","email":"nik.komawar@gmail.com","username":"nikhil-komawar"},"change_message_id":"a1c1637ca8175c624ee9285167f03b686e5206f2","unresolved":false,"context_lines":[{"line_number":16,"context_line":"  - The image signing feature of Glance can be insecure when"},{"line_number":17,"context_line":"    using md5. This has been explained well in bug 1516031,"},{"line_number":18,"context_line":"    deprecation of this usage was done in Mitaka. In newton-1,"},{"line_number":19,"context_line":"    this \u0027sign-the-hash\u0027 appraoch has been removed."},{"line_number":20,"context_line":"    Related CVE-2015-8234."},{"line_number":21,"context_line":"fixes:"},{"line_number":22,"context_line":"  - |"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"9abb7d3a_bc99517b","line":19,"in_reply_to":"9abb7d3a_d9754732","updated":"2016-06-01 18:09:09.000000000","message":"Done","commit_id":"3e3cd2357959c8ed44ada3c5354c16d1956d6ffd"}]}