)]}'
{"security-notes/OSSN-0061":[{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"cfce215b93c40cceffd35f01340a3b99808b2f99","unresolved":false,"context_lines":[{"line_number":17,"context_line":"rehashes the existing MD5 checksum that is used to locally verify the"},{"line_number":18,"context_line":"integrity of image data stored in Glance."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"The Glance image signature algorithm uses SHA256, a suitable algorithm"},{"line_number":21,"context_line":"for this purpose but instead of applying it to the image data it\u0027s"},{"line_number":22,"context_line":"applied only to the MD5 checksum that already exists in Glance. This"},{"line_number":23,"context_line":"degrades the overall security of the algorithm."}],"source_content_type":"application/octet-stream","patch_set":1,"id":"7a740942_0b62793e","line":20,"updated":"2015-12-07 23:06:20.000000000","message":"The image signature algorithm uses a configurable hash method, that can be: SHA-224, SHA-256, SHA-384, or SHA-512 (see https://github.com/openstack/glance/blob/master/glance/common/signature_utils.py#L43-L48).  This statement as-is makes it sound like the image signature algorithm is hard-coded rather than configurable.","commit_id":"d8ad5b95a859e3c2d6ae95472a5ff5a0c5ded45b"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"17e5ad3aa3ad93683bb1c601e02095f6584b94f7","unresolved":false,"context_lines":[{"line_number":17,"context_line":"rehashes the existing MD5 checksum that is used to locally verify the"},{"line_number":18,"context_line":"integrity of image data stored in Glance."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"The Glance image signature algorithm uses SHA256, a suitable algorithm"},{"line_number":21,"context_line":"for this purpose but instead of applying it to the image data it\u0027s"},{"line_number":22,"context_line":"applied only to the MD5 checksum that already exists in Glance. This"},{"line_number":23,"context_line":"degrades the overall security of the algorithm."}],"source_content_type":"application/octet-stream","patch_set":1,"id":"7a740942_b6cdcc86","line":20,"in_reply_to":"7a740942_0b62793e","updated":"2015-12-07 23:30:40.000000000","message":"Done","commit_id":"d8ad5b95a859e3c2d6ae95472a5ff5a0c5ded45b"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"cfce215b93c40cceffd35f01340a3b99808b2f99","unresolved":false,"context_lines":[{"line_number":30,"context_line":"Glance signature algorithm is not secure by todays cryptographic"},{"line_number":31,"context_line":"standards."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"\u003cWaiting for feedback from the Glance team on how/when of a fix\u003e"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"### Contacts / References ###"},{"line_number":36,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0061"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"7a740942_0b97d9ec","line":33,"updated":"2015-12-07 23:06:20.000000000","message":"This was discussed in a mailing list thread (http://lists.openstack.org/pipermail/openstack-dev/2015-November/079348.html) and there is a spec up to make modifications to glance (https://review.openstack.org/#/c/252462/) with the goal of including these modifications in Mitaka.","commit_id":"d8ad5b95a859e3c2d6ae95472a5ff5a0c5ded45b"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"17e5ad3aa3ad93683bb1c601e02095f6584b94f7","unresolved":false,"context_lines":[{"line_number":30,"context_line":"Glance signature algorithm is not secure by todays cryptographic"},{"line_number":31,"context_line":"standards."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"\u003cWaiting for feedback from the Glance team on how/when of a fix\u003e"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"### Contacts / References ###"},{"line_number":36,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0061"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"7a740942_56c6e868","line":33,"in_reply_to":"7a740942_0b97d9ec","updated":"2015-12-07 23:30:40.000000000","message":"Done","commit_id":"d8ad5b95a859e3c2d6ae95472a5ff5a0c5ded45b"}]}