)]}'
{"security-notes/OSSN-0057":[{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"23c93c8aab32b58963c4bbbbb6e595de59bd3e0f","unresolved":false,"context_lines":[{"line_number":1,"context_line":"DoS style attack on Glance service can lead to interruption or disruption"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_3877d703","line":1,"updated":"2015-09-02 22:47:30.000000000","message":"s/style// for line length","commit_id":"95c44031d653f3543f9307b98a4a049d7ddd333b"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"9195a1fae5be6f702e85385214c8378f7570b4df","unresolved":false,"context_lines":[{"line_number":1,"context_line":"DoS style attack on Glance service can lead to interruption or disruption"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_03506409","line":1,"in_reply_to":"da20952f_3877d703","updated":"2015-09-02 22:51:21.000000000","message":"Done","commit_id":"95c44031d653f3543f9307b98a4a049d7ddd333b"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"23c93c8aab32b58963c4bbbbb6e595de59bd3e0f","unresolved":false,"context_lines":[{"line_number":16,"context_line":"and do not hit any limits for size, but do take up space in the"},{"line_number":17,"context_line":"database."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Malicious users can cause database resource depletion with an endless"},{"line_number":20,"context_line":"flood of \u0027image-create\u0027 requests."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"### Recommended Actions ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_b8d0c7ca","line":19,"updated":"2015-09-02 22:47:30.000000000","message":"potentially?","commit_id":"95c44031d653f3543f9307b98a4a049d7ddd333b"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"9195a1fae5be6f702e85385214c8378f7570b4df","unresolved":false,"context_lines":[{"line_number":16,"context_line":"and do not hit any limits for size, but do take up space in the"},{"line_number":17,"context_line":"database."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Malicious users can cause database resource depletion with an endless"},{"line_number":20,"context_line":"flood of \u0027image-create\u0027 requests."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"### Recommended Actions ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_c3590c37","line":19,"in_reply_to":"da20952f_b8d0c7ca","updated":"2015-09-02 22:51:21.000000000","message":"Done","commit_id":"95c44031d653f3543f9307b98a4a049d7ddd333b"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"23c93c8aab32b58963c4bbbbb6e595de59bd3e0f","unresolved":false,"context_lines":[{"line_number":20,"context_line":"flood of \u0027image-create\u0027 requests."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"### Recommended Actions ###"},{"line_number":23,"context_line":"For current stable OpenStack releases, users need to workaround this"},{"line_number":24,"context_line":"vulnerability by using rate-limiting proxies to cover access to the"},{"line_number":25,"context_line":"Glance API.  Rate-limiting is a common mechanism to prevent DoS and"},{"line_number":26,"context_line":"Brute-Force attacks.  Rate limiting on the API requests allows a delay"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_98d623c2","line":23,"updated":"2015-09-02 22:47:30.000000000","message":"s/need/can/ ?","commit_id":"95c44031d653f3543f9307b98a4a049d7ddd333b"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"9195a1fae5be6f702e85385214c8378f7570b4df","unresolved":false,"context_lines":[{"line_number":20,"context_line":"flood of \u0027image-create\u0027 requests."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"### Recommended Actions ###"},{"line_number":23,"context_line":"For current stable OpenStack releases, users need to workaround this"},{"line_number":24,"context_line":"vulnerability by using rate-limiting proxies to cover access to the"},{"line_number":25,"context_line":"Glance API.  Rate-limiting is a common mechanism to prevent DoS and"},{"line_number":26,"context_line":"Brute-Force attacks.  Rate limiting on the API requests allows a delay"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_833c74c0","line":23,"in_reply_to":"da20952f_98d623c2","updated":"2015-09-02 22:51:21.000000000","message":"Done","commit_id":"95c44031d653f3543f9307b98a4a049d7ddd333b"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"ea08f01e02a1eebac6e76b292baa863403878054","unresolved":false,"context_lines":[{"line_number":35,"context_line":"image creates to trusted administrators within your deployed Glance"},{"line_number":36,"context_line":"policy.json file."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"  \"add_image\": \"role:admin\","},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"### Contacts / References ###"},{"line_number":41,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0057"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"da20952f_c30eec8b","line":38,"updated":"2015-09-02 23:05:41.000000000","message":"Should there be any mention here of log monitoring and what a glance create message looks like as these are authenticated users - in theory, users that can be identified and then have action taken against them account lockout, etc...?","commit_id":"9be0ea37fe28b1e9263b7ef81bf8f8141b9c208d"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"48902561e0c639b65d0c0762056291b107d1fbe7","unresolved":false,"context_lines":[{"line_number":35,"context_line":"image creates to trusted administrators within your deployed Glance"},{"line_number":36,"context_line":"policy.json file."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"  \"add_image\": \"role:admin\","},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"### Contacts / References ###"},{"line_number":41,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0057"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"7a2fa921_a5b50532","line":38,"in_reply_to":"ba15a1d1_6de08f29","updated":"2015-10-06 21:22:41.000000000","message":"The best debug message I could find is the following.  Unfortunately, glance doesn\u0027t give a good log message indicating the request.\n\n2015-10-06 21:09:38.989 6142 DEBUG glance.registry.client.v1.api [req-da1cafc0-f41f-4587-a484-672ba7f3546e vio-autouser 8b04efc28055428c940505838314f262 - - -] Adding image metadata... add_image_metadata /usr/lib/python2.7/dist-packages/glance/registry/client/v1/api.py:161","commit_id":"9be0ea37fe28b1e9263b7ef81bf8f8141b9c208d"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"652e2825815babeeaf60f5b96ff460b0874d03c5","unresolved":false,"context_lines":[{"line_number":35,"context_line":"image creates to trusted administrators within your deployed Glance"},{"line_number":36,"context_line":"policy.json file."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"  \"add_image\": \"role:admin\","},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"### Contacts / References ###"},{"line_number":41,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0057"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"ba15a1d1_6de08f29","line":38,"in_reply_to":"ba15a1d1_7c25c659","updated":"2015-09-18 15:29:04.000000000","message":"I agree that the log monitoring idea should be added","commit_id":"9be0ea37fe28b1e9263b7ef81bf8f8141b9c208d"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"2010cc56ff0a3ddc0ccf0503a61376e40379a5fb","unresolved":false,"context_lines":[{"line_number":35,"context_line":"image creates to trusted administrators within your deployed Glance"},{"line_number":36,"context_line":"policy.json file."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"  \"add_image\": \"role:admin\","},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"### Contacts / References ###"},{"line_number":41,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0057"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"ba15a1d1_7c25c659","line":38,"in_reply_to":"ba15a1d1_dadc64e6","updated":"2015-09-17 17:18:47.000000000","message":"+1.  I really think this should be added to the note before publishing.","commit_id":"9be0ea37fe28b1e9263b7ef81bf8f8141b9c208d"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"8a9a6517eab43a2d22648a4123533aece9745ead","unresolved":false,"context_lines":[{"line_number":35,"context_line":"image creates to trusted administrators within your deployed Glance"},{"line_number":36,"context_line":"policy.json file."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"  \"add_image\": \"role:admin\","},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"### Contacts / References ###"},{"line_number":41,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0057"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"ba15a1d1_dadc64e6","line":38,"in_reply_to":"da20952f_610ec18d","updated":"2015-09-16 10:08:15.000000000","message":"+1","commit_id":"9be0ea37fe28b1e9263b7ef81bf8f8141b9c208d"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"39727a987c668331330f9f98aa494cb5d84c801b","unresolved":false,"context_lines":[{"line_number":35,"context_line":"image creates to trusted administrators within your deployed Glance"},{"line_number":36,"context_line":"policy.json file."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"  \"add_image\": \"role:admin\","},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"### Contacts / References ###"},{"line_number":41,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0057"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"da20952f_610ec18d","line":38,"in_reply_to":"da20952f_c30eec8b","updated":"2015-09-04 00:21:51.000000000","message":"this is a nice idea, do the glance logs expose this information at the default levels?","commit_id":"9be0ea37fe28b1e9263b7ef81bf8f8141b9c208d"}]}