)]}'
{"security-notes/OSSN-0048":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"e1fc240dea891047ec504ade343a7fc2cf519833","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Glance using assert for method checking in middleware"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"bab921fb_80f8e8e6","line":1,"updated":"2015-04-23 18:02:35.000000000","message":"maybe we can rephrase this to call attention to the threat:\n\nGlance method filtering doesn\u0027t work under certain conditions","commit_id":"b5a7b0952e42a0d78e23cdc5aeb0d7aa913abb03"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"e23ee8da3aba40c7daf86df81249570906aa8d41","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Glance using assert for method checking in middleware"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"bab921fb_468ae5c0","line":1,"in_reply_to":"bab921fb_80f8e8e6","updated":"2015-04-23 20:12:00.000000000","message":"i like that, much more catchy","commit_id":"b5a7b0952e42a0d78e23cdc5aeb0d7aa913abb03"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"e1fc240dea891047ec504ade343a7fc2cf519833","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Glance is using the Python assert statement for validating the HTTP"},{"line_number":6,"context_line":"method type in it\u0027s caching middleware for some image endpoints. The"},{"line_number":7,"context_line":"Python documentation states that when optimization is requested"},{"line_number":8,"context_line":"(command line option -O), assert statements will not be evaluated."},{"line_number":9,"context_line":"This results in a condition where these method validations will not"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"bab921fb_e0820452","line":6,"updated":"2015-04-23 18:02:35.000000000","message":"*its","commit_id":"b5a7b0952e42a0d78e23cdc5aeb0d7aa913abb03"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"e23ee8da3aba40c7daf86df81249570906aa8d41","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Glance is using the Python assert statement for validating the HTTP"},{"line_number":6,"context_line":"method type in it\u0027s caching middleware for some image endpoints. The"},{"line_number":7,"context_line":"Python documentation states that when optimization is requested"},{"line_number":8,"context_line":"(command line option -O), assert statements will not be evaluated."},{"line_number":9,"context_line":"This results in a condition where these method validations will not"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"bab921fb_86b6bd88","line":6,"in_reply_to":"bab921fb_e0820452","updated":"2015-04-23 20:12:00.000000000","message":"doh! i always do that","commit_id":"b5a7b0952e42a0d78e23cdc5aeb0d7aa913abb03"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"e1fc240dea891047ec504ade343a7fc2cf519833","unresolved":false,"context_lines":[{"line_number":18,"context_line":"for some of the image endpoints in the version 1 and 2 REST interfaces."},{"line_number":19,"context_line":"In circumstances where glance is being run with Python optimization"},{"line_number":20,"context_line":"enabled (by using the -O command line option) these assert statements"},{"line_number":21,"context_line":"will not be evaluated. In these cases the HTTP verb is unchecked for"},{"line_number":22,"context_line":"the requested endpoints."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"The endpoints and methods affected by this are the following:"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"bab921fb_c03ca095","line":21,"updated":"2015-04-23 18:02:35.000000000","message":"* In these cases,","commit_id":"b5a7b0952e42a0d78e23cdc5aeb0d7aa913abb03"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"e23ee8da3aba40c7daf86df81249570906aa8d41","unresolved":false,"context_lines":[{"line_number":18,"context_line":"for some of the image endpoints in the version 1 and 2 REST interfaces."},{"line_number":19,"context_line":"In circumstances where glance is being run with Python optimization"},{"line_number":20,"context_line":"enabled (by using the -O command line option) these assert statements"},{"line_number":21,"context_line":"will not be evaluated. In these cases the HTTP verb is unchecked for"},{"line_number":22,"context_line":"the requested endpoints."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"The endpoints and methods affected by this are the following:"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"bab921fb_46b1c58e","line":21,"in_reply_to":"bab921fb_c03ca095","updated":"2015-04-23 20:12:00.000000000","message":"Done","commit_id":"b5a7b0952e42a0d78e23cdc5aeb0d7aa913abb03"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"ed11fc26a2c37c5fefa0decf760443a7bd017f19","unresolved":false,"context_lines":[{"line_number":33,"context_line":"could circumvent this filtering by matching the endpoint regular"},{"line_number":34,"context_line":"expression and providing a different HTTP verb. In this example"},{"line_number":35,"context_line":"an attacker would be able to download or delete images from glance."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"### Recommended Actions ###"},{"line_number":38,"context_line":"As of the Kilo-3 release of glance this vulnerability has been patched"},{"line_number":39,"context_line":"and backported to the Icehouse and Juno releases. All deployed versions"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"bab921fb_e12c43ad","line":36,"updated":"2015-04-23 20:51:23.000000000","message":"Can you add an example of a maliciously crafted request?  That would help to bring this whole thing home.","commit_id":"35d1692b1024d9aaec708a485f8cf6d55dab79c1"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"d0ad1d4813e28f8307dbf6de3d20241a118a4b9d","unresolved":false,"context_lines":[{"line_number":17,"context_line":"Glance uses the Python assert statement to validate the HTTP method"},{"line_number":18,"context_line":"for some of the image endpoints in the version 1 and 2 REST interfaces."},{"line_number":19,"context_line":"In circumstances where glance is being run with Python optimization"},{"line_number":20,"context_line":"enabled (by using the -O command line option) these assert statements"},{"line_number":21,"context_line":"will not be evaluated. In these cases, the HTTP verb is unchecked for"},{"line_number":22,"context_line":"the requested endpoints."},{"line_number":23,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7ad32947_47044e7d","line":20,"updated":"2015-04-27 20:12:50.000000000","message":"(nit) Add a comma here after the closing parenthesis.","commit_id":"6f15539ae6a2d27c1dbf4b733daca90ad69c1450"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"d1fa72cb11d8d99eeb824ee813ca692bfa961f05","unresolved":false,"context_lines":[{"line_number":17,"context_line":"Glance uses the Python assert statement to validate the HTTP method"},{"line_number":18,"context_line":"for some of the image endpoints in the version 1 and 2 REST interfaces."},{"line_number":19,"context_line":"In circumstances where glance is being run with Python optimization"},{"line_number":20,"context_line":"enabled (by using the -O command line option) these assert statements"},{"line_number":21,"context_line":"will not be evaluated. In these cases, the HTTP verb is unchecked for"},{"line_number":22,"context_line":"the requested endpoints."},{"line_number":23,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7ad32947_4bcf9b56","line":20,"in_reply_to":"7ad32947_47044e7d","updated":"2015-04-28 18:04:05.000000000","message":"Done","commit_id":"6f15539ae6a2d27c1dbf4b733daca90ad69c1450"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"d0ad1d4813e28f8307dbf6de3d20241a118a4b9d","unresolved":false,"context_lines":[{"line_number":21,"context_line":"will not be evaluated. In these cases, the HTTP verb is unchecked for"},{"line_number":22,"context_line":"the requested endpoints."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"The endpoints and methods affected by this are the following:"},{"line_number":25,"context_line":"* GET on /v1/images/{image_id}"},{"line_number":26,"context_line":"* DELETE on /v1/images/{image_id}"},{"line_number":27,"context_line":"* GET on /v2/images/{image_id}/file"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7ad32947_27e272d6","line":24,"updated":"2015-04-27 20:12:50.000000000","message":"(nit) It would be nice to add a blank line here for readability.","commit_id":"6f15539ae6a2d27c1dbf4b733daca90ad69c1450"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"d1fa72cb11d8d99eeb824ee813ca692bfa961f05","unresolved":false,"context_lines":[{"line_number":21,"context_line":"will not be evaluated. In these cases, the HTTP verb is unchecked for"},{"line_number":22,"context_line":"the requested endpoints."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"The endpoints and methods affected by this are the following:"},{"line_number":25,"context_line":"* GET on /v1/images/{image_id}"},{"line_number":26,"context_line":"* DELETE on /v1/images/{image_id}"},{"line_number":27,"context_line":"* GET on /v2/images/{image_id}/file"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7ad32947_2bdc5f11","line":24,"in_reply_to":"7ad32947_27e272d6","updated":"2015-04-28 18:04:05.000000000","message":"Done","commit_id":"6f15539ae6a2d27c1dbf4b733daca90ad69c1450"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"d0ad1d4813e28f8307dbf6de3d20241a118a4b9d","unresolved":false,"context_lines":[{"line_number":44,"context_line":"filtering."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"### Recommended Actions ###"},{"line_number":47,"context_line":"As of the Kilo-3 release of glance this vulnerability has been patched"},{"line_number":48,"context_line":"and backported to the Icehouse and Juno releases. All deployed versions"},{"line_number":49,"context_line":"of glance should be updated to the current patch level for their"},{"line_number":50,"context_line":"release."}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7ad32947_87770602","line":47,"updated":"2015-04-27 20:12:50.000000000","message":"(nit) Add a comma after \"glance\".","commit_id":"6f15539ae6a2d27c1dbf4b733daca90ad69c1450"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"d1fa72cb11d8d99eeb824ee813ca692bfa961f05","unresolved":false,"context_lines":[{"line_number":44,"context_line":"filtering."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"### Recommended Actions ###"},{"line_number":47,"context_line":"As of the Kilo-3 release of glance this vulnerability has been patched"},{"line_number":48,"context_line":"and backported to the Icehouse and Juno releases. All deployed versions"},{"line_number":49,"context_line":"of glance should be updated to the current patch level for their"},{"line_number":50,"context_line":"release."}],"source_content_type":"application/octet-stream","patch_set":4,"id":"5ad0253b_6ff60dd9","line":47,"in_reply_to":"7ad32947_87770602","updated":"2015-04-28 18:04:05.000000000","message":"Done","commit_id":"6f15539ae6a2d27c1dbf4b733daca90ad69c1450"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"d0ad1d4813e28f8307dbf6de3d20241a118a4b9d","unresolved":false,"context_lines":[{"line_number":47,"context_line":"As of the Kilo-3 release of glance this vulnerability has been patched"},{"line_number":48,"context_line":"and backported to the Icehouse and Juno releases. All deployed versions"},{"line_number":49,"context_line":"of glance should be updated to the current patch level for their"},{"line_number":50,"context_line":"release."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"### Contacts / References ###"},{"line_number":53,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0048"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7ad32947_e7d59ab9","line":50,"updated":"2015-04-27 20:12:50.000000000","message":"It would be nice to provide the exact Icehouse and Juno stable update versions of glance where this is fixed.","commit_id":"6f15539ae6a2d27c1dbf4b733daca90ad69c1450"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"0637dd426503dd908152b2334faa4996d5d45043","unresolved":false,"context_lines":[{"line_number":47,"context_line":"As of the Kilo-3 release of glance this vulnerability has been patched"},{"line_number":48,"context_line":"and backported to the Icehouse and Juno releases. All deployed versions"},{"line_number":49,"context_line":"of glance should be updated to the current patch level for their"},{"line_number":50,"context_line":"release."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"### Contacts / References ###"},{"line_number":53,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0048"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"5ad0253b_cfdc0149","line":50,"in_reply_to":"7ad32947_e7d59ab9","updated":"2015-04-28 18:04:40.000000000","message":"Done","commit_id":"6f15539ae6a2d27c1dbf4b733daca90ad69c1450"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"d0ad1d4813e28f8307dbf6de3d20241a118a4b9d","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"### Contacts / References ###"},{"line_number":53,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0048"},{"line_number":54,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1414532"},{"line_number":55,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":56,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":57,"context_line":"Python assert documentation: https://docs.python.org/3/reference/simple_stmts.html#the-assert-statement"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7ad32947_e7ec7a91","line":54,"updated":"2015-04-27 20:12:50.000000000","message":"This link should be the glance bug, not the ossn bug:\n\n  https://bugs.launchpad.net/glance/+bug/1414532","commit_id":"6f15539ae6a2d27c1dbf4b733daca90ad69c1450"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"d1fa72cb11d8d99eeb824ee813ca692bfa961f05","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"### Contacts / References ###"},{"line_number":53,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0048"},{"line_number":54,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1414532"},{"line_number":55,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":56,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":57,"context_line":"Python assert documentation: https://docs.python.org/3/reference/simple_stmts.html#the-assert-statement"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7ad32947_6bf93780","line":54,"in_reply_to":"7ad32947_e7ec7a91","updated":"2015-04-28 18:04:05.000000000","message":"Done","commit_id":"6f15539ae6a2d27c1dbf4b733daca90ad69c1450"}]}