Glance needs a config option to limit the number of additional image properties
Bug #1251518 reported by
Brian Rosmaita
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Glance |
Fix Released
|
Critical
|
Alex Meade | ||
OpenStack Security Advisory |
Invalid
|
Undecided
|
Unassigned |
Bug Description
Impact: The vulnerability occurs when glance is directly exposed to users. If users can only hit glance via the compute API, then no vulnerability.
Nova has a configuration option quota_metadata_
Glance does not appear to have such an option (I was able to put >500 additional properties on an image using the glanceclient). I think this is a DOS attack vector, since someone could fill the glance database with garbage and slow everything down.
Changed in ossa: | |
status: | Incomplete → Invalid |
Changed in glance: | |
status: | New → Triaged |
importance: | Undecided → Critical |
milestone: | none → icehouse-1 |
Changed in glance: | |
assignee: | nobody → Alex Meade (alex-meade) |
Changed in glance: | |
status: | Triaged → In Progress |
Changed in glance: | |
status: | Fix Committed → Fix Released |
Changed in glance: | |
milestone: | icehouse-1 → 2014.1 |
To post a comment you must log in.
Hmmm. Agree on the usefulness of such a setting, but should it be considered a vulnerability ? I wonder if that would not fall under the "normal usage" for a public service: people using your service will grow the database behind it, so you have to have mitigation in place to prevent normal usage from triggering DoS.
The question is... where is the line ? When should normal usage be considered a DoS vector ? When it's easy to do ? When it's anonymous to do ? When it's free to do ? When you can leverage quadratic blowup ? So far we considered the combination of the last two (free + blowup) to constitute a vulnerability. Not so sure about other combinations (here we have easy + free IIUC).