| 2015-02-20 19:19:46 |
Hemanth Makkapati |
bug |
|
|
added bug |
| 2015-02-20 19:29:08 |
Tristan Cacqueray |
bug task added |
|
ossa |
|
| 2015-02-20 19:29:14 |
Tristan Cacqueray |
ossa: status |
New |
Incomplete |
|
| 2015-02-20 19:57:03 |
Nikhil Komawar |
glance: status |
New |
Triaged |
|
| 2015-02-20 19:57:10 |
Nikhil Komawar |
glance: importance |
Undecided |
High |
|
| 2015-02-20 20:09:53 |
Jeremy Stanley |
bug |
|
|
added subscriber Glance Core security contacts |
| 2015-02-20 20:10:46 |
Jeremy Stanley |
description |
When adding a member to an image, if the member name is longer than 255 characters, Glance registry fails with a 500.
Reproduction in devstack:
glance member-create 749f53d4-896b-436c-b742-6e01d3d700e8 663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663asdsadasdsadsadasdsadasd1
HTTPInternalServerError (HTTP 500)
Error in registry logs:
DBError: (DataError) (1406, "Data too long for column 'member' at row 1") 'INSERT INTO image_members (created_at, updated_at, deleted_at, deleted, image_id, member, can_share, status) VALUES (%s, %s, %s, %s, %s, %s, %s, %s)' (datetime.datetime(2015, 2, 20, 19, 8, 15, 862789), datetime.datetime(2015, 2, 20, 19, 8, 15, 862800), None, 0, '749f53d4-896b-436c-b742-6e01d3d700e8', '663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663asdsadasdsadsadasdsadasd1', 0, 'pending')
2015-02-20 19:08:16.380 18844 INFO glance.wsgi.server [9719e12b-9926-47f4-a8a6-93430a792bec ca44bfc7c1e4421287bb6517be22e34d 4ccaf93d792a4a2880a60d32feeee570 - - -] 127.0.0.1 - - [20/Feb/2015 19:08:16] "PUT /images/749f53d4-896b-436c-b742-6e01d3d700e8/members/663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663asdsadasdsadsadasdsadasd1 HTTP/1.1" 500 139 0.538550 |
This issue is being treated as a potential security risk under embargo. Please do not make any public mention of embargoed (private) security vulnerabilities before their coordinated publication by the OpenStack Vulnerability Management Team in the form of an official OpenStack Security Advisory. This includes discussion of the bug or associated fixes in public forums such as mailing lists, code review systems and bug trackers. Please also avoid private disclosure to other individuals not already approved for access to this information, and provide this same reminder to those who are made aware of the issue prior to publication. All discussion should remain confined to this private bug report, and any proposed fixes should be added as to the bug as attachments.
When adding a member to an image, if the member name is longer than 255 characters, Glance registry fails with a 500.
Reproduction in devstack:
glance member-create 749f53d4-896b-436c-b742-6e01d3d700e8 663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663asdsadasdsadsadasdsadasd1
HTTPInternalServerError (HTTP 500)
Error in registry logs:
DBError: (DataError) (1406, "Data too long for column 'member' at row 1") 'INSERT INTO image_members (created_at, updated_at, deleted_at, deleted, image_id, member, can_share, status) VALUES (%s, %s, %s, %s, %s, %s, %s, %s)' (datetime.datetime(2015, 2, 20, 19, 8, 15, 862789), datetime.datetime(2015, 2, 20, 19, 8, 15, 862800), None, 0, '749f53d4-896b-436c-b742-6e01d3d700e8', '663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663asdsadasdsadsadasdsadasd1', 0, 'pending')
2015-02-20 19:08:16.380 18844 INFO glance.wsgi.server [9719e12b-9926-47f4-a8a6-93430a792bec ca44bfc7c1e4421287bb6517be22e34d 4ccaf93d792a4a2880a60d32feeee570 - - -] 127.0.0.1 - - [20/Feb/2015 19:08:16] "PUT /images/749f53d4-896b-436c-b742-6e01d3d700e8/members/663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663asdsadasdsadsadasdsadasd1 HTTP/1.1" 500 139 0.538550 |
|
| 2015-02-20 20:13:55 |
Hemanth Makkapati |
glance: assignee |
|
Hemanth Makkapati (hemanth-makkapati) |
|
| 2015-03-05 10:39:47 |
Thierry Carrez |
ossa: status |
Incomplete |
Won't Fix |
|
| 2015-03-05 10:39:53 |
Thierry Carrez |
information type |
Private Security |
Public |
|
| 2015-04-14 21:27:52 |
Jeremy Stanley |
description |
This issue is being treated as a potential security risk under embargo. Please do not make any public mention of embargoed (private) security vulnerabilities before their coordinated publication by the OpenStack Vulnerability Management Team in the form of an official OpenStack Security Advisory. This includes discussion of the bug or associated fixes in public forums such as mailing lists, code review systems and bug trackers. Please also avoid private disclosure to other individuals not already approved for access to this information, and provide this same reminder to those who are made aware of the issue prior to publication. All discussion should remain confined to this private bug report, and any proposed fixes should be added as to the bug as attachments.
When adding a member to an image, if the member name is longer than 255 characters, Glance registry fails with a 500.
Reproduction in devstack:
glance member-create 749f53d4-896b-436c-b742-6e01d3d700e8 663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663asdsadasdsadsadasdsadasd1
HTTPInternalServerError (HTTP 500)
Error in registry logs:
DBError: (DataError) (1406, "Data too long for column 'member' at row 1") 'INSERT INTO image_members (created_at, updated_at, deleted_at, deleted, image_id, member, can_share, status) VALUES (%s, %s, %s, %s, %s, %s, %s, %s)' (datetime.datetime(2015, 2, 20, 19, 8, 15, 862789), datetime.datetime(2015, 2, 20, 19, 8, 15, 862800), None, 0, '749f53d4-896b-436c-b742-6e01d3d700e8', '663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663asdsadasdsadsadasdsadasd1', 0, 'pending')
2015-02-20 19:08:16.380 18844 INFO glance.wsgi.server [9719e12b-9926-47f4-a8a6-93430a792bec ca44bfc7c1e4421287bb6517be22e34d 4ccaf93d792a4a2880a60d32feeee570 - - -] 127.0.0.1 - - [20/Feb/2015 19:08:16] "PUT /images/749f53d4-896b-436c-b742-6e01d3d700e8/members/663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663asdsadasdsadsadasdsadasd1 HTTP/1.1" 500 139 0.538550 |
When adding a member to an image, if the member name is longer than 255 characters, Glance registry fails with a 500.
Reproduction in devstack:
glance member-create 749f53d4-896b-436c-b742-6e01d3d700e8 663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663asdsadasdsadsadasdsadasd1
HTTPInternalServerError (HTTP 500)
Error in registry logs:
DBError: (DataError) (1406, "Data too long for column 'member' at row 1") 'INSERT INTO image_members (created_at, updated_at, deleted_at, deleted, image_id, member, can_share, status) VALUES (%s, %s, %s, %s, %s, %s, %s, %s)' (datetime.datetime(2015, 2, 20, 19, 8, 15, 862789), datetime.datetime(2015, 2, 20, 19, 8, 15, 862800), None, 0, '749f53d4-896b-436c-b742-6e01d3d700e8', '663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663asdsadasdsadsadasdsadasd1', 0, 'pending')
2015-02-20 19:08:16.380 18844 INFO glance.wsgi.server [9719e12b-9926-47f4-a8a6-93430a792bec ca44bfc7c1e4421287bb6517be22e34d 4ccaf93d792a4a2880a60d32feeee570 - - -] 127.0.0.1 - - [20/Feb/2015 19:08:16] "PUT /images/749f53d4-896b-436c-b742-6e01d3d700e8/members/663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663051afadfasdfadsf663asdsadasdsadsadasdsadasd1 HTTP/1.1" 500 139 0.538550 |
|
| 2015-04-20 12:50:52 |
Kamil Rykowski |
glance: assignee |
Hemanth Makkapati (hemanth-makkapati) |
Kamil Rykowski (kamil-rykowski) |
|
| 2015-04-20 12:50:57 |
Kamil Rykowski |
glance: status |
Triaged |
In Progress |
|
| 2020-12-07 23:52:04 |
Brian Rosmaita |
tags |
|
image-sharing |
|
| 2021-06-17 07:54:21 |
Abhishek Kekane |
glance: status |
In Progress |
Won't Fix |
|
