leak access_key in logs

[lujiefsi]

see https://github.com/openstack/glance_store/blob/6f5011d1f05c99894fb8b909d33ad23a20bf83a9/glance_store/_drivers/s3.py#L628

Plain access key from glance_store exist in the logs.

many other similar vulnerabilities, like:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3585

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0718

[lujiefsi (lujiefsi)]

any update for this issue?

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/glance_store/+/906087

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/glance_store/+/906087
Committed: https://opendev.org/openstack/glance_store/commit/a5ba027922ba1230b4ae9abb810f36427be6354a
Submitter: "Zuul (22348)"
Branch: master

commit a5ba027922ba1230b4ae9abb810f36427be6354a
Author: lujie <email address hidden>
Date: Fri Jan 19 13:12:20 2024 +0800

    Do not show access_key in s3 driver

    Closes-Bug: #2047688
    Change-Id: I9193df38d613259b61bb369fa1040fb2c51a21d7

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/glance_store/+/906185

[Takashi Kajinami (kajinamit)]

The fix is incomplete and we have to fix a few more places. See the related change above.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/glance_store/+/906185
Committed: https://opendev.org/openstack/glance_store/commit/d6e531af4821c8466b1e9404f12f89f6216417f2
Submitter: "Zuul (22348)"
Branch: master

commit d6e531af4821c8466b1e9404f12f89f6216417f2
Author: Takashi Kajinami <email address hidden>
Date: Sun Jan 21 02:09:05 2024 +0900

    s3: Do not log access keys

    The previous attempt a5ba027922ba1230b4ae9abb810f36427be6354a was
    incomplete and there are still a few more logs where access keys are
    logged. This fixes these to avoid leaking access keys to log.

    Related-Bug: #2047688
    Change-Id: I8dc564bed33d6fc71965f4f573ae9109b410b1d4

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/2023.2
Review: https://review.opendev.org/c/openstack/glance_store/+/906481

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/2023.2
Review: https://review.opendev.org/c/openstack/glance_store/+/906484

[lujiefsi (lujiefsi)]

Can I apply for a CVE ? Since many such similar vulnerabilities in OpenStack have been granted CVEs.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/glance_store/+/907733

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/glance_store/+/907734

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/zed
Review: https://review.opendev.org/c/openstack/glance_store/+/907736

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/zed
Review: https://review.opendev.org/c/openstack/glance_store/+/907737

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/glance_store/+/907738

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/glance_store/+/907739

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Brian Rosmaita <email address hidden>" on branch: stable/yoga
Review: https://review.opendev.org/c/openstack/glance_store/+/907738
Reason: As discussed at today's Glance meeting [0], this patch will be abandoned and re-proposed to unmaintained/yoga

[0] https://meetings.opendev.org/meetings/glance/2024/glance.2024-02-08-14.00.log.html

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Brian Rosmaita <email address hidden>" on branch: stable/yoga
Review: https://review.opendev.org/c/openstack/glance_store/+/907739
Reason: As discussed at today's Glance meeting [0], this patch will be abandoned and re-proposed to unmaintained/yoga

[0] https://meetings.opendev.org/meetings/glance/2024/glance.2024-02-08-14.00.log.html

[Jeremy Stanley (fungi)]

Sorry for not weighing in on this sooner, but I only just stumbled across this when spotting an unfamiliar-looking security advisory issued by Ubuntu and then discovered that private security bug reports for glance_store were not set to be automatically shared with the OpenStack vulnerability managers. I've used access through our admin group to add this now, so we hopefully shouldn't miss similar reports in the future.

Thanks for reporting this. Judging from the fix which was merged, this only logs credentials at DEBUG log level, and sharing debug logs with untrusted parties is strongly discouraged. The VMT considers this a class B3 report per our taxonomy so won't be issuing any official advisory: https://security.openstack.org/vmt-process.html#report-taxonomy

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Brian Rosmaita <email address hidden>" on branch: stable/2023.2
Review: https://review.opendev.org/c/openstack/glance_store/+/906481
Reason: This change has been squashed into https://review.opendev.org/c/openstack/glance_store/+/906484

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Brian Rosmaita <email address hidden>" on branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/glance_store/+/907734
Reason: No longer needed; see https://review.opendev.org/c/openstack/glance_store/+/906484

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Brian Rosmaita <email address hidden>" on branch: stable/zed
Review: https://review.opendev.org/c/openstack/glance_store/+/907737
Reason: No longer needed; see https://review.opendev.org/c/openstack/glance_store/+/906484

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: unmaintained/yoga
Review: https://review.opendev.org/c/openstack/glance_store/+/909173

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/glance_store 4.7.0 release.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/glance_store/+/907736
Committed: https://opendev.org/openstack/glance_store/commit/f7f87019adbcdb069ea23ccb7b3e187cb52eaf55
Submitter: "Zuul (22348)"
Branch: stable/zed

commit f7f87019adbcdb069ea23ccb7b3e187cb52eaf55
Author: lujie <email address hidden>
Date: Fri Jan 19 13:12:20 2024 +0800

    Do not show access_key in s3 driver

    Avoid possible leakage of s3 access keys by not including them in log
    messages.

    This patch includes commit d6e531af4821c8466b1e9404f12f89f6216417f2
    (change I8dc564bed33d6fc71965f4f573ae9109b410b1d4), which addressed
    some more log messages that the original patch had missed.

    The two commits are squashed here for ease in backporting (and also
    to make sure that *both* are always backported).

    Closes-Bug: #2047688
    Change-Id: I9193df38d613259b61bb369fa1040fb2c51a21d7
    (cherry picked from commit a5ba027922ba1230b4ae9abb810f36427be6354a)
    (cherry picked from commit 1583aebb69befea3173396ea161cf896b7d51beb)
    (cherry picked from commit 45ad5df01fa7062ba7d3ec99966531623e35ab57)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/glance_store/+/907733
Committed: https://opendev.org/openstack/glance_store/commit/45ad5df01fa7062ba7d3ec99966531623e35ab57
Submitter: "Zuul (22348)"
Branch: stable/2023.1

commit 45ad5df01fa7062ba7d3ec99966531623e35ab57
Author: lujie <email address hidden>
Date: Fri Jan 19 13:12:20 2024 +0800

    Do not show access_key in s3 driver

    Avoid possible leakage of s3 access keys by not including them in log
    messages.

    This patch includes commit d6e531af4821c8466b1e9404f12f89f6216417f2
    (change I8dc564bed33d6fc71965f4f573ae9109b410b1d4), which addressed
    some more log messages that the original patch had missed.

    The two commits are squashed here for ease in backporting (and also
    to make sure that *both* are always backported).

    Closes-Bug: #2047688
    Change-Id: I9193df38d613259b61bb369fa1040fb2c51a21d7
    (cherry picked from commit a5ba027922ba1230b4ae9abb810f36427be6354a)
    (cherry picked from commit 1583aebb69befea3173396ea161cf896b7d51beb)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/glance_store/+/906484
Committed: https://opendev.org/openstack/glance_store/commit/1583aebb69befea3173396ea161cf896b7d51beb
Submitter: "Zuul (22348)"
Branch: stable/2023.2

commit 1583aebb69befea3173396ea161cf896b7d51beb
Author: lujie <email address hidden>
Date: Fri Jan 19 13:12:20 2024 +0800

    Do not show access_key in s3 driver

    Avoid possible leakage of s3 access keys by not including them in log
    messages.

    This patch includes commit d6e531af4821c8466b1e9404f12f89f6216417f2
    (change I8dc564bed33d6fc71965f4f573ae9109b410b1d4), which addressed
    some more log messages that the original patch had missed.

    The two commits are squashed here for ease in backporting (and also
    to make sure that *both* are always backported).

    Closes-Bug: #2047688
    Change-Id: I9193df38d613259b61bb369fa1040fb2c51a21d7
    (cherry picked from commit a5ba027922ba1230b4ae9abb810f36427be6354a)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/glance_store/+/909173
Committed: https://opendev.org/openstack/glance_store/commit/cb75bcb06bc870d0debcd210c4d0144a5688e76e
Submitter: "Zuul (22348)"
Branch: unmaintained/yoga

commit cb75bcb06bc870d0debcd210c4d0144a5688e76e
Author: lujie <email address hidden>
Date: Fri Jan 19 13:12:20 2024 +0800

    Do not show access_key in s3 driver

    Avoid possible leakage of s3 access keys by not including them in log
    messages.

    This patch includes commit d6e531af4821c8466b1e9404f12f89f6216417f2
    (change I8dc564bed33d6fc71965f4f573ae9109b410b1d4), which addressed
    some more log messages that the original patch had missed.

    The two commits are squashed here for ease in backporting (and also
    to make sure that *both* are always backported).

    Closes-Bug: #2047688
    Change-Id: I9193df38d613259b61bb369fa1040fb2c51a21d7
    (cherry picked from commit a5ba027922ba1230b4ae9abb810f36427be6354a)
    (cherry picked from commit 1583aebb69befea3173396ea161cf896b7d51beb)
    (cherry picked from commit 45ad5df01fa7062ba7d3ec99966531623e35ab57)
    (cherry picked from commit f7f87019adbcdb069ea23ccb7b3e187cb52eaf55)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/glance_store 4.3.3 release.