Comment 205 for bug 2059809

Revision history for this message
Thomas Goirand (thomas-goirand) wrote : Re: Arbitrary file access through QCOW2 external data file (CVE-2024-32498)

Compared to Caracal, it's possible that my patchset for Glance in Victoria was missing this:

+ new_size = os.stat(dest_path).st_size
+ action.set_image_attribute(size=new_size)
+ LOG.info(_LI('Updated image %s size=%i disk_format=%s'),
+ self.image_id, new_size, target_format)

but:
1/ that's still not enough
2/ add this breaks unit tests

I've put the tempest logs over here:
http://shade.infomaniak.ch/test_image_glance_direct_import.txt

If you need the glance logs, let me know, but basically, this in loop:

DEBUG eventlet.wsgi.server [-] (822021) accepted ('192.168.101.2', 42016) server /usr/lib/python3/dist-packages/eventlet/wsgi.py:992
DEBUG glance.api.middleware.version_negotiation [-] Determining version of request: GET /v2/images/9135c6fd-74ca-4cfe-88e7-2e008510128b Accept: application/json process_request /usr/lib/python3/dist-packages/glance/api/middleware/version_negotiation.py:44
DEBUG glance.api.middleware.version_negotiation [-] Using url versioning process_request /usr/lib/python3/dist-packages/glance/api/middleware/version_negotiation.py:57
DEBUG glance.api.middleware.version_negotiation [-] Matched version: v2 process_request /usr/lib/python3/dist-packages/glance/api/middleware/version_negotiation.py:69
DEBUG glance.api.middleware.version_negotiation [-] new path /v2/images/9135c6fd-74ca-4cfe-88e7-2e008510128b process_request /usr/lib/python3/dist-packages/glance/api/middleware/version_negotiation.py:70
INFO eventlet.wsgi.server [req-b5ebf61b-b67f-484d-932f-94fcf53878db e0921b84f30b46d493dfc9585627a289 89156cdfffa7458a9c8e0ba2e17623fe - default default] 192.168.101.133,192.168.101.2 - - [27/Jun/2024 10:55:38] "GET /v2/images/9135c6fd-74ca-4cfe-88e7-2e008510128b HTTP/1.1" 200 928 0.026395
DEBUG eventlet.wsgi.server [-] (822021) accepted ('192.168.101.2', 42024) server /usr/lib/python3/dist-packages/eventlet/wsgi.py:992
...