)]}'
{"id":"openstack%2Fglance~981300","triplet_id":"openstack%2Fglance~unmaintained%2F2023.1~Ib8d337dc68411d18c70d5712cc4f0986ef6205f4","project":"openstack/glance","branch":"unmaintained/2023.1","topic":"bug-2138602-ssrf","attention_set":{"9303":{"account":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"last_update":"2026-03-19 16:45:11.000000000","reason":"A robot voted negatively on a label"},"8122":{"account":{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},"last_update":"2026-03-19 16:47:15.000000000","reason":"Vote got outdated and was removed: Code-Review+1"}},"removed_from_attention_set":{},"hashtags":[],"change_id":"Ib8d337dc68411d18c70d5712cc4f0986ef6205f4","subject":"Fix SSRF vulnerabilities in image import API","status":"NEW","created":"2026-03-19 14:38:29.000000000","updated":"2026-03-23 09:33:31.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"35641ea94173ad936699fb16f89cef3d47ce342f","_number":981300,"virtual_id_number":981300,"owner":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"actions":{},"labels":{"Verified":{"disliked":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},{"tag":"autogenerated:zuul:check","value":-1,"date":"2026-03-19 19:15:07.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":-1,"default_value":0,"optional":true},"Code-Review":{"disliked":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"all":[{"value":-1,"date":"2026-03-23 09:33:31.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","value":-1,"default_value":0,"optional":true},"Workflow":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Review-Priority":{"all":[{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},{"value":0,"permitted_voting_range":{"min":-1,"max":2},"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Branch Freeze"," 0":"No Priority","+1":"Important Change","+2":"Top Priority / Holds Gate"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-03-19 14:41:26.000000000","updated_by":{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},"reviewer":{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},"state":"REVIEWER"},{"updated":"2026-03-19 16:45:11.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-03-23 09:33:31.000000000","updated_by":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"reviewer":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"state":"REVIEWER"}],"messages":[{"id":"4fc887ca636989d2bfc704cff600a5c66db55686","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"date":"2026-03-19 14:38:29.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"078303ddcd7c930eebdfaff44bf751a6de639c61","author":{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},"date":"2026-03-19 14:41:26.000000000","message":"Patch Set 1: Code-Review+1","accounts_in_message":[],"_revision_number":1},{"id":"da09becaf1244301959a3bdda49412aaa42372a4","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-03-19 16:45:11.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/95eef153d9ab42dd9a03cc001c25adbd\n\n- grenade https://zuul.opendev.org/t/openstack/build/a0d2e8a2aa674a798c5293ee4a3aea6d : SUCCESS in 1h 00m 10s\n- tempest-integrated-storage https://zuul.opendev.org/t/openstack/build/7937fb990bc949078f44e885b473d0c3 : SUCCESS in 1h 12m 30s\n- openstacksdk-functional-devstack https://zuul.opendev.org/t/openstack/build/125ba7ce063d40cbae6c1e28288e0b02 : SUCCESS in 53m 53s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/0d14b1900b9d4bb0ab811be07b3ae9e2 : SUCCESS in 2m 38s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/1887940c8c3b49019ec63e26d1de4f6b : FAILURE in 3m 37s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/664bd90748834bbfaa829a5399a4d020 : SUCCESS in 5m 27s\n- openstack-tox-functional-py39 https://zuul.opendev.org/t/openstack/build/99322c0b3a5a4e2497f24423075891d4 : FAILURE in 2m 32s\n- glance-tox-functional-py39-rbac-defaults https://zuul.opendev.org/t/openstack/build/7afd92f077e44193bcf9bd902f00ad4d : FAILURE in 4m 02s (non-voting)\n- glance-ceph-thin-provisioning https://zuul.opendev.org/t/openstack/build/5a2027e4e62841fd9c091c5f53bfe8b7 : SUCCESS in 1h 32m 44s (non-voting)\n- tempest-integrated-storage-enforce-scope-new-defaults https://zuul.opendev.org/t/openstack/build/48275d98320b46cbb1cddd4fad7d8eea : SUCCESS in 1h 28m 26s\n- tempest-integrated-storage-import https://zuul.opendev.org/t/openstack/build/89849d73af054cc4a25d59d483b05357 : FAILURE in 1h 22m 34s\n- tempest-integrated-storage-import-standalone https://zuul.opendev.org/t/openstack/build/4328f8be01eb4107aff2c8e5e43a737c : SUCCESS in 1h 23m 09s\n- glance-multistore-cinder-import https://zuul.opendev.org/t/openstack/build/0992c8c9a02e40438556c521ae774c52 : SUCCESS in 1h 58m 08s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/7dbb8797e144412cb4df88dc43f548bd : SUCCESS in 29m 23s\n- nova-ceph-multistore https://zuul.opendev.org/t/openstack/build/026aaa303d394ceda8b181624d1626fb : FAILURE in 2h 04m 13s\n- glance-secure-rbac-protection-functional https://zuul.opendev.org/t/openstack/build/6633e9edf54f4770a43af05ac9515100 : SUCCESS in 36m 31s","accounts_in_message":[],"_revision_number":1},{"id":"69dd0940b1aa266870d44668f9da979fb41bba48","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"date":"2026-03-19 16:47:15.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Code-Review+1 (copy condition: \"changekind:TRIVIAL_REBASE OR is:MIN\")\n* Verified-1\n","accounts_in_message":[],"_revision_number":2},{"id":"486f3689ee450b2daff020057b08f7afb3a84dde","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"date":"2026-03-19 17:16:35.000000000","message":"Patch Set 3: Commit message was updated.","accounts_in_message":[],"_revision_number":3},{"id":"1e5facc1c604b0c48b2283de47747e93db863c43","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-03-19 19:15:07.000000000","message":"Patch Set 3: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/06c0838fd7564c7994067c1a525f1286\n\n- grenade https://zuul.opendev.org/t/openstack/build/1e6a32e08be04ccc8b82dc65c2d92786 : SUCCESS in 56m 32s\n- tempest-integrated-storage https://zuul.opendev.org/t/openstack/build/7d3771de0cac44a983ca3672365e3327 : SUCCESS in 1h 22m 25s\n- openstacksdk-functional-devstack https://zuul.opendev.org/t/openstack/build/716963c35f6947d6b2fc2337186de98e : SUCCESS in 57m 59s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/d74f8796ec554b1ba1b5d88e88169002 : SUCCESS in 7m 06s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/dc06b0f94b5b4dc587d8b96bc1133ed1 : SUCCESS in 5m 32s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/a241779d14d6436cb3f3c8b7d5596364 : SUCCESS in 3m 41s\n- openstack-tox-functional-py39 https://zuul.opendev.org/t/openstack/build/e74f8551dbe74322ac034bd69799ff5a : FAILURE in 6m 54s\n- glance-tox-functional-py39-rbac-defaults https://zuul.opendev.org/t/openstack/build/8ed963e438dc4844b797ae255a23f7de : SUCCESS in 8m 45s (non-voting)\n- glance-ceph-thin-provisioning https://zuul.opendev.org/t/openstack/build/5fdc042b4db4413fbab963ae60bfd7e4 : SUCCESS in 1h 48m 22s (non-voting)\n- tempest-integrated-storage-enforce-scope-new-defaults https://zuul.opendev.org/t/openstack/build/ad5035c4040b4bf1a5ce706b698eea2c : SUCCESS in 1h 11m 45s\n- tempest-integrated-storage-import https://zuul.opendev.org/t/openstack/build/12f0f8ab338643e5836f021a257cdc95 : SUCCESS in 41m 14s\n- tempest-integrated-storage-import-standalone https://zuul.opendev.org/t/openstack/build/70a9b38083394ad5941e396bd2fa3819 : SUCCESS in 1h 15m 23s\n- glance-multistore-cinder-import https://zuul.opendev.org/t/openstack/build/92bababcc69547d1a32e68b272ca620f : SUCCESS in 49m 04s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/ea4d4e154d194c61a74626d1c9322574 : SUCCESS in 55m 12s\n- nova-ceph-multistore https://zuul.opendev.org/t/openstack/build/bd8faedca8184d85843f397ab6a36516 : FAILURE in 1h 43m 06s\n- glance-secure-rbac-protection-functional https://zuul.opendev.org/t/openstack/build/ca5cfa449eb6481a8b4ddcb5ac81fb2d : SUCCESS in 31m 33s","accounts_in_message":[],"_revision_number":3},{"id":"c34d321c70318b62e0e187d6eff8bee87a5c8a9c","tag":"autogenerated:gerrit:setTopic","author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"date":"2026-03-20 13:12:13.000000000","message":"Topic set to bug-2138602-ssrf","accounts_in_message":[],"_revision_number":3},{"id":"35641ea94173ad936699fb16f89cef3d47ce342f","author":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"date":"2026-03-23 09:33:31.000000000","message":"Patch Set 3: Code-Review-1\n\n(1 comment)","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"8e4835d35aedf7b335761fb2c80cb659df8ec983","revisions":{"bb875920cb465a573f927bff424b71dc3684a014":{"kind":"REWORK","_number":1,"created":"2026-03-19 14:38:29.000000000","uploader":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"ref":"refs/changes/00/981300/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/glance","ref":"refs/changes/00/981300/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/glance refs/changes/00/981300/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/glance refs/changes/00/981300/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/glance refs/changes/00/981300/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/glance refs/changes/00/981300/1"}}},"commit":{"parents":[{"commit":"1fd12c29b339f30fe823e2b5beba14b5f241e52a","subject":"Update .gitreview for unmaintained/2023.1","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/glance/commit/1fd12c29b339f30fe823e2b5beba14b5f241e52a"}]}],"author":{"name":"Abhishek Kekane","email":"akekane@redhat.com","date":"2026-02-17 07:11:39.000000000","tz":0},"committer":{"name":"Abhishek Kekane","email":"akekane@redhat.com","date":"2026-03-19 14:37:09.000000000","tz":0},"subject":"Fix SSRF vulnerabilities in image import API","message":"Fix SSRF vulnerabilities in image import API\n\nFixed Server-Side Request Forgery (SSRF) vulnerabilities in Glance\u0027s image\nimport functionality that could allow attackers to bypass URL validation\nand access internal resources.\n\nThe fix includes:\n- IP address validation using Python\u0027s ipaddress module to reject encoded\n  IP formats (decimal, hexadecimal, octal) that could bypass blacklist checks\n- HTTP redirect validation for web-download, glance-download, and OVF\n  processing to prevent redirect-based SSRF attacks\n- URI validation for OVF processing which previously had no protection\n\nThe implementation uses Python\u0027s built-in ipaddress module which inherently\nrejects all non-standard IP encodings and only accepts standard formats,\nproviding robust protection against IP encoding bypass attacks.\n\nAssisted-by: Used Cursor (Auto) for unit tests.\n\nCloses-Bug: #2138602\nCloses-Bug: #2138672\nCloses-Bug: #2138675\nSecurityImpact\n\nConflicts:\n    glance/tests/functional/v2/test_images.py\n    glance/tests/unit/common/test_utils.py\n\nChange-Id: Ib8d337dc68411d18c70d5712cc4f0986ef6205f4\nSigned-off-by: Abhishek Kekane \u003cakekane@redhat.com\u003e\n(cherry picked from commit 38040d086bf6c159f45d201f361a71e7a32e62af)\n(cherry picked from commit e9cdb9ff2bc44677e028a370cb5606343227beb6)\n(cherry picked from commit b03e8a911173946221fea3f7dacf78c18a0a6494)\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/glance/commit/bb875920cb465a573f927bff424b71dc3684a014"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/glance/commit/bb875920cb465a573f927bff424b71dc3684a014"}]},"branch":"refs/heads/unmaintained/2023.1"},"347d30df3ebecef78a6066bfacfed7cd0fe80cb8":{"kind":"REWORK","_number":2,"created":"2026-03-19 16:47:15.000000000","uploader":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"ref":"refs/changes/00/981300/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/glance","ref":"refs/changes/00/981300/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/glance refs/changes/00/981300/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/glance refs/changes/00/981300/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/glance refs/changes/00/981300/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/glance refs/changes/00/981300/2"}}},"commit":{"parents":[{"commit":"1fd12c29b339f30fe823e2b5beba14b5f241e52a","subject":"Update .gitreview for unmaintained/2023.1","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/glance/commit/1fd12c29b339f30fe823e2b5beba14b5f241e52a"}]}],"author":{"name":"Abhishek Kekane","email":"akekane@redhat.com","date":"2026-02-17 07:11:39.000000000","tz":0},"committer":{"name":"Abhishek Kekane","email":"akekane@redhat.com","date":"2026-03-19 16:44:36.000000000","tz":0},"subject":"Fix SSRF vulnerabilities in image import API","message":"Fix SSRF vulnerabilities in image import API\n\nFixed Server-Side Request Forgery (SSRF) vulnerabilities in Glance\u0027s image\nimport functionality that could allow attackers to bypass URL validation\nand access internal resources.\n\nThe fix includes:\n- IP address validation using Python\u0027s ipaddress module to reject encoded\n  IP formats (decimal, hexadecimal, octal) that could bypass blacklist checks\n- HTTP redirect validation for web-download, glance-download, and OVF\n  processing to prevent redirect-based SSRF attacks\n- URI validation for OVF processing which previously had no protection\n\nThe implementation uses Python\u0027s built-in ipaddress module which inherently\nrejects all non-standard IP encodings and only accepts standard formats,\nproviding robust protection against IP encoding bypass attacks.\n\nPinned setuptools\u003c82 in doc reqs and fix SSRF reno note for Sphinx/doc8\nAssisted-by: Used Cursor (Auto) for unit tests.\n\nCloses-Bug: #2138602\nCloses-Bug: #2138672\nCloses-Bug: #2138675\nSecurityImpact\n\nConflicts:\n    glance/tests/functional/v2/test_images.py\n    glance/tests/unit/common/test_utils.py\n\nChange-Id: Ib8d337dc68411d18c70d5712cc4f0986ef6205f4\nSigned-off-by: Abhishek Kekane \u003cakekane@redhat.com\u003e\n(cherry picked from commit 38040d086bf6c159f45d201f361a71e7a32e62af)\n(cherry picked from commit e9cdb9ff2bc44677e028a370cb5606343227beb6)\n(cherry picked from commit b03e8a911173946221fea3f7dacf78c18a0a6494)\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/glance/commit/347d30df3ebecef78a6066bfacfed7cd0fe80cb8"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/glance/commit/347d30df3ebecef78a6066bfacfed7cd0fe80cb8"}]},"branch":"refs/heads/unmaintained/2023.1"},"8e4835d35aedf7b335761fb2c80cb659df8ec983":{"kind":"NO_CODE_CHANGE","_number":3,"created":"2026-03-19 17:16:35.000000000","uploader":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"ref":"refs/changes/00/981300/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/glance","ref":"refs/changes/00/981300/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/glance refs/changes/00/981300/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/glance refs/changes/00/981300/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/glance refs/changes/00/981300/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/glance refs/changes/00/981300/3"}}},"commit":{"parents":[{"commit":"1fd12c29b339f30fe823e2b5beba14b5f241e52a","subject":"Update .gitreview for unmaintained/2023.1","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/glance/commit/1fd12c29b339f30fe823e2b5beba14b5f241e52a"}]}],"author":{"name":"Abhishek Kekane","email":"akekane@redhat.com","date":"2026-02-17 07:11:39.000000000","tz":0},"committer":{"name":"Abhishek Kekane","email":"akekane@redhat.com","date":"2026-03-19 17:16:35.000000000","tz":0},"subject":"Fix SSRF vulnerabilities in image import API","message":"Fix SSRF vulnerabilities in image import API\n\nFixed Server-Side Request Forgery (SSRF) vulnerabilities in Glance\u0027s image\nimport functionality that could allow attackers to bypass URL validation\nand access internal resources.\n\nThe fix includes:\n- IP address validation using Python\u0027s ipaddress module to reject encoded\n  IP formats (decimal, hexadecimal, octal) that could bypass blacklist checks\n- HTTP redirect validation for web-download, glance-download, and OVF\n  processing to prevent redirect-based SSRF attacks\n- URI validation for OVF processing which previously had no protection\n\nThe implementation uses Python\u0027s built-in ipaddress module which inherently\nrejects all non-standard IP encodings and only accepts standard formats,\nproviding robust protection against IP encoding bypass attacks.\n\nPinned setuptools\u003c82 in doc reqs and fix SSRF reno note for Sphinx/doc8\n\nDepends-On: https://review.opendev.org/c/openstack/tempest/+/981329\nAssisted-by: Used Cursor (Auto) for unit tests.\n\nCloses-Bug: #2138602\nCloses-Bug: #2138672\nCloses-Bug: #2138675\nSecurityImpact\n\nConflicts:\n    glance/tests/functional/v2/test_images.py\n    glance/tests/unit/common/test_utils.py\n\nChange-Id: Ib8d337dc68411d18c70d5712cc4f0986ef6205f4\nSigned-off-by: Abhishek Kekane \u003cakekane@redhat.com\u003e\n(cherry picked from commit 38040d086bf6c159f45d201f361a71e7a32e62af)\n(cherry picked from commit e9cdb9ff2bc44677e028a370cb5606343227beb6)\n(cherry picked from commit b03e8a911173946221fea3f7dacf78c18a0a6494)\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/glance/commit/8e4835d35aedf7b335761fb2c80cb659df8ec983"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/glance/commit/8e4835d35aedf7b335761fb2c80cb659df8ec983"}]},"branch":"refs/heads/unmaintained/2023.1","description":"Edit commit message"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"}},{"label":"Workflow","status":"MAY"},{"label":"Review-Priority","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Review-Priority","description":"Review priority","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"-label:Review-Priority\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":[],"failing_atoms":["label:Review-Priority\u003dMIN"],"atom_explanations":{"label:Review-Priority\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}