)]}'
{"security-notes/OSSN-0077":[{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"4caefa8183b3c126910a80708cd9403df6acde0c","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Title (single sentence)"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9a629dbe_9d1bdfc9","line":1,"range":{"start_line":1,"start_character":0,"end_line":1,"end_character":23},"updated":"2016-11-10 10:39:41.000000000","message":"This needs to be the actual title:\n\n\"Pre-auth COPY in versioned_writes can result in a successful COPY that wouldn\u0027t have been authorized\"","commit_id":"9fdf71454f24e7a213b4f4c0e367b47f488dfbde"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"4caefa8183b3c126910a80708cd9403df6acde0c","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"This issue is related to the versioning feature of swift and potentially allows unauthorized users to drive up the storage usage of a third party account."},{"line_number":6,"context_line":"Specifically a user can create versions of existing objects belonging to tenants for which he has no authorization."},{"line_number":7,"context_line":"The malicious user cannot read or write the specific object, or create objects with arbitrary content."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":""},{"line_number":10,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9a629dbe_dd50f734","line":7,"range":{"start_line":5,"start_character":0,"end_line":7,"end_character":102},"updated":"2016-11-10 10:39:41.000000000","message":"Documentation lines should not exceed 79 characters (you should see a dotted red vertical line on this gerrit page.","commit_id":"9fdf71454f24e7a213b4f4c0e367b47f488dfbde"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"4caefa8183b3c126910a80708cd9403df6acde0c","unresolved":false,"context_lines":[{"line_number":12,"context_line":"Swift \u003c 2.10.0"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":"A versioned write PUT uses a pre-authed request to move an object into the versioned container before checking whether the user is authorised. So a user can select a versioned object path that it does not have access to, request a put on that versioned object, and the request will execute the copy part before it fails due to lack of permissions."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"### Recommended Actions ###"},{"line_number":18,"context_line":"Update Swift to version 2.10.0 where possible."}],"source_content_type":"application/octet-stream","patch_set":1,"id":"9a629dbe_7d2d2ba7","line":15,"range":{"start_line":15,"start_character":0,"end_line":15,"end_character":347},"updated":"2016-11-10 10:39:41.000000000","message":"79 characters","commit_id":"9fdf71454f24e7a213b4f4c0e367b47f488dfbde"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"7cba2bf1e1d434f9d6673fcb522f63877eb94922","unresolved":false,"context_lines":[{"line_number":1,"context_line":"\"Pre-auth COPY in versioned_writes can result in a successful COPY that wouldn\u0027t have been authorized\""},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a629dbe_3804a148","line":1,"range":{"start_line":1,"start_character":0,"end_line":1,"end_character":102},"updated":"2016-11-10 10:56:20.000000000","message":"This is what is causing `gate-security-doc-tox-checkniceness-ubuntu-xenial` to fail. I would do a carriage return after \u0027been\u0027 and before \u0027authorized\u0027.","commit_id":"5e5a9831015e30a298b137a80b44875e251274b4"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"09328eedb7a74413a26b5392a63472983c12a1ea","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"This issue is related to the versioning feature of swift and potentially"},{"line_number":6,"context_line":"allows unauthorized users to drive up the storage usage of a third party"},{"line_number":7,"context_line":"account."},{"line_number":8,"context_line":"Specifically a user can create versions of existing objects belonging to"},{"line_number":9,"context_line":"tenants for which he has no authorization."},{"line_number":10,"context_line":"The malicious user cannot read or write the specific object, or create"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a629dbe_386f412c","line":7,"range":{"start_line":7,"start_character":0,"end_line":7,"end_character":8},"updated":"2016-11-10 10:54:42.000000000","message":"carriage return after line 7 for next paragraph.","commit_id":"5e5a9831015e30a298b137a80b44875e251274b4"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"09328eedb7a74413a26b5392a63472983c12a1ea","unresolved":false,"context_lines":[{"line_number":10,"context_line":"The malicious user cannot read or write the specific object, or create"},{"line_number":11,"context_line":"objects with arbitrary content."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Affected Services / Software ###"},{"line_number":16,"context_line":"Swift \u003c 2.10.0"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a629dbe_7847f9bb","line":13,"range":{"start_line":13,"start_character":0,"end_line":13,"end_character":0},"updated":"2016-11-10 10:54:42.000000000","message":"remove blank lines 13 / 14","commit_id":"5e5a9831015e30a298b137a80b44875e251274b4"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"cba8fa2c112bb80a5838ee80830848bc1438f6e7","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Pre-auth COPY in versioned_writes can result in a successful COPY that wouldn\u0027t have been authorized"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"9a629dbe_083f7887","line":1,"range":{"start_line":1,"start_character":80,"end_line":1,"end_character":100},"updated":"2016-11-10 17:30:23.000000000","message":"line wrap","commit_id":"c2a9ed8e30fc92e61342e1d5872da07b508ee0c5"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"cba8fa2c112bb80a5838ee80830848bc1438f6e7","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Specifically a user can create versions of existing objects belonging to"},{"line_number":10,"context_line":"tenants for which he has no authorization."},{"line_number":11,"context_line":"The malicious user cannot read or write the specific object, or create"},{"line_number":12,"context_line":"objects with arbitrary content."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"9a629dbe_e86404ba","line":11,"range":{"start_line":11,"start_character":0,"end_line":11,"end_character":3},"updated":"2016-11-10 17:30:23.000000000","message":"Maybe move to previous line","commit_id":"c2a9ed8e30fc92e61342e1d5872da07b508ee0c5"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"5a8e6621d163169fa474b6c969d48fb0c335859a","unresolved":false,"context_lines":[{"line_number":8,"context_line":"account."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"Specifically a user can create versions of existing objects belonging to"},{"line_number":11,"context_line":"tenants for which he has no authorization. The malicious user cannot"},{"line_number":12,"context_line":"read or write the specific object, or create objects with arbitrary content."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"9a629dbe_4de07429","line":11,"range":{"start_line":11,"start_character":0,"end_line":11,"end_character":7},"updated":"2016-11-11 18:18:28.000000000","message":"projects","commit_id":"b5fc5030d22700b0386b8c5401a3bfb3eb8692c8"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"5a8e6621d163169fa474b6c969d48fb0c335859a","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"### Discussion ###"},{"line_number":18,"context_line":"A versioned write PUT uses a pre-authed request to move an object into"},{"line_number":19,"context_line":"the versioned container before checking whether the user is authorised."},{"line_number":20,"context_line":"So a user can select a versioned object path that it does not have access to,"},{"line_number":21,"context_line":"request a put on that versioned object, and the request will execute the copy"},{"line_number":22,"context_line":"part before it fails due to lack of permissions."}],"source_content_type":"application/octet-stream","patch_set":7,"id":"9a629dbe_2dcc20ba","line":19,"range":{"start_line":19,"start_character":60,"end_line":19,"end_character":70},"updated":"2016-11-11 18:18:28.000000000","message":"authorized (above you used z, so to be consistent)","commit_id":"b5fc5030d22700b0386b8c5401a3bfb3eb8692c8"}]}