'X-Openstack-Request-ID' lenght limited only by header size

[Erno Kuvaja]

Glance accepts 'X-Openstack-Request-ID' header and includes the value in log-files. The length of the Request ID is limited only by max_header_line parameter that defaults to 16384. This opens possibility to flood the logs.

Public as this vulnerability was already discussed today on Glance weekly meeting.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/210025

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/210026

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/juno
Review: https://review.openstack.org/210042

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/kilo
Review: https://review.openstack.org/210044

[Tristan Cacqueray (tristan-cacqueray)]

Since this report concerns a possible security risk, an incomplete security advisory task has been added while the core security reviewers for the affected project or projects confirm the bug and discuss the scope of any vulnerability along with potential solutions.

It seems like all affected logs are DEBUG, does it also happen without DEBUG ?

[Kirill Zaitsev (kzaitsev)]

I believe all the OS projects follow this pattern. Shouldn't we raise propogate this concern to oslo guys and other project teams?

[Tristan Cacqueray (tristan-cacqueray)]

It doesn't seems to affect last Kilo release ( openstack-glance-2015.1.1-1.el7.noarch ).
Unless this affects a stable release without DEBUG mode, then we are going to remove the OSSA tasks.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/210025
Committed: https://git.openstack.org/cgit/openstack/glance/commit/?id=9fdc92b57bfb1e92fdb90e9bffc07bd928801630
Submitter: Jenkins
Branch: master

commit 9fdc92b57bfb1e92fdb90e9bffc07bd928801630
Author: Erno Kuvaja <email address hidden>
Date: Thu Aug 6 16:29:28 2015 +0000

    Add mechanism to limit Request ID size

    Adding 'max_request_id_length' defaulting to 0 for backportability.

    DocImpact
    SecurityImpact

    Closes-Bug: #1482301
    Change-Id: Ie68afe7610a414bbcc42ff3bee33a9779303c115

[OpenStack Infra (hudson-openstack)]

Change abandoned by Erno Kuvaja (<email address hidden>) on branch: stable/kilo
Review: https://review.openstack.org/210044
Reason: Kilo not affected

[OpenStack Infra (hudson-openstack)]

Change abandoned by Erno Kuvaja (<email address hidden>) on branch: stable/juno
Review: https://review.openstack.org/210042

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/210026
Committed: https://git.openstack.org/cgit/openstack/glance/commit/?id=bd593ddbe67715534b404f3138298ab1232490f5
Submitter: Jenkins
Branch: master

commit bd593ddbe67715534b404f3138298ab1232490f5
Author: Erno Kuvaja <email address hidden>
Date: Thu Aug 6 16:33:07 2015 +0000

    Setting default max_request_id_length to 64

    Setting sensible maximum size for Request ID. 64 should be enough for
    normal use cases but limited enough from current 16384 to not flood
    the logs by malicious requests.

    DocImpact
    SecurityImpact

    Related-to-bug: #1482301
    Change-Id: I52ebf810f4699826baa2bdf91d28e24d902cf950