Glance

  1. Bug #1916922
  2. Activity log

Activity log for bug #1916922

Date Who What changed Old value New value Message
2021-02-25 16:11:14 Lance Bragstad bug added bug
2021-02-25 16:12:17 Lance Bragstad description As a user of a project, I can see resource types associated to private namespaces I don't have access to: ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ source alicerc ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ openstack token issue /usr/lib/python3/dist-packages/secretstorage/dhcrypto.py:15: CryptographyDeprecationWarning: int_from_bytes is deprecated, use int.from_bytes instead from cryptography.utils import int_from_bytes /usr/lib/python3/dist-packages/secretstorage/util.py:19: CryptographyDeprecationWarning: int_from_bytes is deprecated, use int.from_bytes instead from cryptography.utils import int_from_bytes +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Field | Value | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | expires | 2021-02-25T16:54:12+0000 | | id | gAAAAABgN8gkFiVP108Fi8-OaWdPklyi0_UN3UrEE_q4d5HGqYXFZy5rZ5Mf_MUnAJx-VFJmBMXsM_pxQDyP07O8R8rBHNC6hhayqRXnwCDg6LGAwdYP9kJP5Fcx2_2WHmeqdXwLwc7I88XP7v1SJqjkb0D0JEFYoPq4qne4Jk9Raq5JaJ-DKUo | | project_id | 67f1495e5dc145abbfa7059c63c6eda2 | | user_id | 91cdb182eaf841f4869e66d6b0f0f32a | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-namespace-list +------------------------------------------+ | namespace | +------------------------------------------+ | OS::Software::DBMS | | CIM::ResourceAllocationSettingData | | OS::Compute::CPUPinning | | OS::Compute::Watchdog | | OS::Compute::GuestMemoryBacking | | OS::Compute::AggregateDiskFilter | | OS::Compute::RandomNumberGenerator | | OS::Compute::Hypervisor | | OS::Compute::AggregateIoOpsFilter | | OS::Compute::VirtCPUTopology | | OS::Compute::HostCapabilities | | CIM::ProcessorAllocationSettingData | | OS::Compute::GuestShutdownBehavior | | OS::Cinder::Volumetype | | OS::Software::WebServers | | OS::Compute::Libvirt | | OS::Compute::XenAPI | | OS::Compute::Quota | | OS::Compute::VMwareFlavor | | OS::Compute::VMwareQuotaFlavor | | OS::Compute::InstanceData | | OS::Compute::LibvirtImage | | OS::Compute::AggregateNumInstancesFilter | | OS::Glance::Signatures | | CIM::VirtualSystemSettingData | | CIM::StorageAllocationSettingData | | OS::Software::Runtimes | | OS::Compute::VMware | +------------------------------------------+ ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-namespace-create alice-namespace +------------+----------------------------------+ | Property | Value | +------------+----------------------------------+ | created_at | 2021-02-25T15:55:55Z | | namespace | alice-namespace | | owner | 67f1495e5dc145abbfa7059c63c6eda2 | | protected | False | | schema | /v2/schemas/metadefs/namespace | | updated_at | 2021-02-25T15:55:55Z | | visibility | private | +------------+----------------------------------+ ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-resource-type-associate --name alice-resource-type alice-namespace +------------+----------------------+ | Property | Value | +------------+----------------------+ | created_at | 2021-02-25T15:57:29Z | | name | alice-resource-type | | updated_at | 2021-02-25T15:57:29Z | +------------+----------------------+ Now as a separate user ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ source openrc demo demo is_service_enabled:29: command not found: set +o xtrace WARNING: setting legacy OS_TENANT_NAME to support cli tools. ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-resource-type-list +---------------------+ | name | +---------------------+ | OS::Glance::Image | | OS::Cinder::Volume | | OS::Nova::Server | | OS::Nova::Aggregate | | OS::Nova::Flavor | | OS::Trove::Instance | | bar | | test | | alice-resource-type | +---------------------+ As a user of a project, I can see resource types associated to private namespaces I don't have access to: ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ cat alicerc export OS_CACERT= export OS_PROJECT_NAME=separate export OS_USERNAME=alice export OS_PASSWORD=password export OS_REGION_NAME=RegionOne export OS_IDENTITY_API_VERSION=3 export OS_AUTH_TYPE=password export OS_AUTH_URL=http://192.168.1.155/identity export OS_USER_DOMAIN_ID=default export OS_PROJECT_DOMAIN_ID=default export OS_VOLUME_API_VERSION=3 ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ source alicerc ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-namespace-list +------------------------------------------+ | namespace | +------------------------------------------+ | OS::Software::DBMS | | CIM::ResourceAllocationSettingData | | OS::Compute::CPUPinning | | OS::Compute::Watchdog | | OS::Compute::GuestMemoryBacking | | OS::Compute::AggregateDiskFilter | | OS::Compute::RandomNumberGenerator | | OS::Compute::Hypervisor | | OS::Compute::AggregateIoOpsFilter | | OS::Compute::VirtCPUTopology | | OS::Compute::HostCapabilities | | CIM::ProcessorAllocationSettingData | | OS::Compute::GuestShutdownBehavior | | OS::Cinder::Volumetype | | OS::Software::WebServers | | OS::Compute::Libvirt | | OS::Compute::XenAPI | | OS::Compute::Quota | | OS::Compute::VMwareFlavor | | OS::Compute::VMwareQuotaFlavor | | OS::Compute::InstanceData | | OS::Compute::LibvirtImage | | OS::Compute::AggregateNumInstancesFilter | | OS::Glance::Signatures | | CIM::VirtualSystemSettingData | | CIM::StorageAllocationSettingData | | OS::Software::Runtimes | | OS::Compute::VMware | +------------------------------------------+ ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-namespace-create alice-namespace +------------+----------------------------------+ | Property | Value | +------------+----------------------------------+ | created_at | 2021-02-25T15:55:55Z | | namespace | alice-namespace | | owner | 67f1495e5dc145abbfa7059c63c6eda2 | | protected | False | | schema | /v2/schemas/metadefs/namespace | | updated_at | 2021-02-25T15:55:55Z | | visibility | private | +------------+----------------------------------+ ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-resource-type-associate --name alice-resource-type alice-namespace +------------+----------------------+ | Property | Value | +------------+----------------------+ | created_at | 2021-02-25T15:57:29Z | | name | alice-resource-type | | updated_at | 2021-02-25T15:57:29Z | +------------+----------------------+ Now as a separate user ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ source openrc demo demo is_service_enabled:29: command not found: set +o xtrace WARNING: setting legacy OS_TENANT_NAME to support cli tools. ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-resource-type-list +---------------------+ | name | +---------------------+ | OS::Glance::Image | | OS::Cinder::Volume | | OS::Nova::Server | | OS::Nova::Aggregate | | OS::Nova::Flavor | | OS::Trove::Instance | | bar | | test | | alice-resource-type | +---------------------+
2021-02-25 19:01:40 Jeremy Stanley description As a user of a project, I can see resource types associated to private namespaces I don't have access to: ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ cat alicerc export OS_CACERT= export OS_PROJECT_NAME=separate export OS_USERNAME=alice export OS_PASSWORD=password export OS_REGION_NAME=RegionOne export OS_IDENTITY_API_VERSION=3 export OS_AUTH_TYPE=password export OS_AUTH_URL=http://192.168.1.155/identity export OS_USER_DOMAIN_ID=default export OS_PROJECT_DOMAIN_ID=default export OS_VOLUME_API_VERSION=3 ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ source alicerc ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-namespace-list +------------------------------------------+ | namespace | +------------------------------------------+ | OS::Software::DBMS | | CIM::ResourceAllocationSettingData | | OS::Compute::CPUPinning | | OS::Compute::Watchdog | | OS::Compute::GuestMemoryBacking | | OS::Compute::AggregateDiskFilter | | OS::Compute::RandomNumberGenerator | | OS::Compute::Hypervisor | | OS::Compute::AggregateIoOpsFilter | | OS::Compute::VirtCPUTopology | | OS::Compute::HostCapabilities | | CIM::ProcessorAllocationSettingData | | OS::Compute::GuestShutdownBehavior | | OS::Cinder::Volumetype | | OS::Software::WebServers | | OS::Compute::Libvirt | | OS::Compute::XenAPI | | OS::Compute::Quota | | OS::Compute::VMwareFlavor | | OS::Compute::VMwareQuotaFlavor | | OS::Compute::InstanceData | | OS::Compute::LibvirtImage | | OS::Compute::AggregateNumInstancesFilter | | OS::Glance::Signatures | | CIM::VirtualSystemSettingData | | CIM::StorageAllocationSettingData | | OS::Software::Runtimes | | OS::Compute::VMware | +------------------------------------------+ ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-namespace-create alice-namespace +------------+----------------------------------+ | Property | Value | +------------+----------------------------------+ | created_at | 2021-02-25T15:55:55Z | | namespace | alice-namespace | | owner | 67f1495e5dc145abbfa7059c63c6eda2 | | protected | False | | schema | /v2/schemas/metadefs/namespace | | updated_at | 2021-02-25T15:55:55Z | | visibility | private | +------------+----------------------------------+ ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-resource-type-associate --name alice-resource-type alice-namespace +------------+----------------------+ | Property | Value | +------------+----------------------+ | created_at | 2021-02-25T15:57:29Z | | name | alice-resource-type | | updated_at | 2021-02-25T15:57:29Z | +------------+----------------------+ Now as a separate user ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ source openrc demo demo is_service_enabled:29: command not found: set +o xtrace WARNING: setting legacy OS_TENANT_NAME to support cli tools. ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-resource-type-list +---------------------+ | name | +---------------------+ | OS::Glance::Image | | OS::Cinder::Volume | | OS::Nova::Server | | OS::Nova::Aggregate | | OS::Nova::Flavor | | OS::Trove::Instance | | bar | | test | | alice-resource-type | +---------------------+ This issue is being treated as a potential security risk under embargo. Please do not make any public mention of embargoed (private) security vulnerabilities before their coordinated publication by the OpenStack Vulnerability Management Team in the form of an official OpenStack Security Advisory. This includes discussion of the bug or associated fixes in public forums such as mailing lists, code review systems and bug trackers. Please also avoid private disclosure to other individuals not already approved for access to this information, and provide this same reminder to those who are made aware of the issue prior to publication. All discussion should remain confined to this private bug report, and any proposed fixes should be added to the bug as attachments. This embargo shall not extend past 2021-05-26 and will be made public by or on that date even if no fix is identified. As a user of a project, I can see resource types associated to private namespaces I don't have access to: ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ cat alicerc export OS_CACERT= export OS_PROJECT_NAME=separate export OS_USERNAME=alice export OS_PASSWORD=password export OS_REGION_NAME=RegionOne export OS_IDENTITY_API_VERSION=3 export OS_AUTH_TYPE=password export OS_AUTH_URL=http://192.168.1.155/identity export OS_USER_DOMAIN_ID=default export OS_PROJECT_DOMAIN_ID=default export OS_VOLUME_API_VERSION=3 ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ source alicerc ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-namespace-list +------------------------------------------+ | namespace | +------------------------------------------+ | OS::Software::DBMS | | CIM::ResourceAllocationSettingData | | OS::Compute::CPUPinning | | OS::Compute::Watchdog | | OS::Compute::GuestMemoryBacking | | OS::Compute::AggregateDiskFilter | | OS::Compute::RandomNumberGenerator | | OS::Compute::Hypervisor | | OS::Compute::AggregateIoOpsFilter | | OS::Compute::VirtCPUTopology | | OS::Compute::HostCapabilities | | CIM::ProcessorAllocationSettingData | | OS::Compute::GuestShutdownBehavior | | OS::Cinder::Volumetype | | OS::Software::WebServers | | OS::Compute::Libvirt | | OS::Compute::XenAPI | | OS::Compute::Quota | | OS::Compute::VMwareFlavor | | OS::Compute::VMwareQuotaFlavor | | OS::Compute::InstanceData | | OS::Compute::LibvirtImage | | OS::Compute::AggregateNumInstancesFilter | | OS::Glance::Signatures | | CIM::VirtualSystemSettingData | | CIM::StorageAllocationSettingData | | OS::Software::Runtimes | | OS::Compute::VMware | +------------------------------------------+ ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-namespace-create alice-namespace +------------+----------------------------------+ | Property | Value | +------------+----------------------------------+ | created_at | 2021-02-25T15:55:55Z | | namespace | alice-namespace | | owner | 67f1495e5dc145abbfa7059c63c6eda2 | | protected | False | | schema | /v2/schemas/metadefs/namespace | | updated_at | 2021-02-25T15:55:55Z | | visibility | private | +------------+----------------------------------+ ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-resource-type-associate --name alice-resource-type alice-namespace +------------+----------------------+ | Property | Value | +------------+----------------------+ | created_at | 2021-02-25T15:57:29Z | | name | alice-resource-type | | updated_at | 2021-02-25T15:57:29Z | +------------+----------------------+ Now as a separate user ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ source openrc demo demo is_service_enabled:29: command not found: set +o xtrace WARNING: setting legacy OS_TENANT_NAME to support cli tools. ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-resource-type-list +---------------------+ | name | +---------------------+ | OS::Glance::Image | | OS::Cinder::Volume | | OS::Nova::Server | | OS::Nova::Aggregate | | OS::Nova::Flavor | | OS::Trove::Instance | | bar | | test | | alice-resource-type | +---------------------+
2021-02-25 19:01:59 Jeremy Stanley bug task added ossa
2021-02-25 19:02:28 Jeremy Stanley ossa: status New Incomplete
2021-02-25 19:02:44 Jeremy Stanley bug added subscriber Glance Core security contacts
2021-02-26 15:59:38 Jeremy Stanley bug added subscriber Dan Smith
2021-03-09 14:55:20 Jeremy Stanley description This issue is being treated as a potential security risk under embargo. Please do not make any public mention of embargoed (private) security vulnerabilities before their coordinated publication by the OpenStack Vulnerability Management Team in the form of an official OpenStack Security Advisory. This includes discussion of the bug or associated fixes in public forums such as mailing lists, code review systems and bug trackers. Please also avoid private disclosure to other individuals not already approved for access to this information, and provide this same reminder to those who are made aware of the issue prior to publication. All discussion should remain confined to this private bug report, and any proposed fixes should be added to the bug as attachments. This embargo shall not extend past 2021-05-26 and will be made public by or on that date even if no fix is identified. As a user of a project, I can see resource types associated to private namespaces I don't have access to: ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ cat alicerc export OS_CACERT= export OS_PROJECT_NAME=separate export OS_USERNAME=alice export OS_PASSWORD=password export OS_REGION_NAME=RegionOne export OS_IDENTITY_API_VERSION=3 export OS_AUTH_TYPE=password export OS_AUTH_URL=http://192.168.1.155/identity export OS_USER_DOMAIN_ID=default export OS_PROJECT_DOMAIN_ID=default export OS_VOLUME_API_VERSION=3 ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ source alicerc ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-namespace-list +------------------------------------------+ | namespace | +------------------------------------------+ | OS::Software::DBMS | | CIM::ResourceAllocationSettingData | | OS::Compute::CPUPinning | | OS::Compute::Watchdog | | OS::Compute::GuestMemoryBacking | | OS::Compute::AggregateDiskFilter | | OS::Compute::RandomNumberGenerator | | OS::Compute::Hypervisor | | OS::Compute::AggregateIoOpsFilter | | OS::Compute::VirtCPUTopology | | OS::Compute::HostCapabilities | | CIM::ProcessorAllocationSettingData | | OS::Compute::GuestShutdownBehavior | | OS::Cinder::Volumetype | | OS::Software::WebServers | | OS::Compute::Libvirt | | OS::Compute::XenAPI | | OS::Compute::Quota | | OS::Compute::VMwareFlavor | | OS::Compute::VMwareQuotaFlavor | | OS::Compute::InstanceData | | OS::Compute::LibvirtImage | | OS::Compute::AggregateNumInstancesFilter | | OS::Glance::Signatures | | CIM::VirtualSystemSettingData | | CIM::StorageAllocationSettingData | | OS::Software::Runtimes | | OS::Compute::VMware | +------------------------------------------+ ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-namespace-create alice-namespace +------------+----------------------------------+ | Property | Value | +------------+----------------------------------+ | created_at | 2021-02-25T15:55:55Z | | namespace | alice-namespace | | owner | 67f1495e5dc145abbfa7059c63c6eda2 | | protected | False | | schema | /v2/schemas/metadefs/namespace | | updated_at | 2021-02-25T15:55:55Z | | visibility | private | +------------+----------------------------------+ ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-resource-type-associate --name alice-resource-type alice-namespace +------------+----------------------+ | Property | Value | +------------+----------------------+ | created_at | 2021-02-25T15:57:29Z | | name | alice-resource-type | | updated_at | 2021-02-25T15:57:29Z | +------------+----------------------+ Now as a separate user ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ source openrc demo demo is_service_enabled:29: command not found: set +o xtrace WARNING: setting legacy OS_TENANT_NAME to support cli tools. ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-resource-type-list +---------------------+ | name | +---------------------+ | OS::Glance::Image | | OS::Cinder::Volume | | OS::Nova::Server | | OS::Nova::Aggregate | | OS::Nova::Flavor | | OS::Trove::Instance | | bar | | test | | alice-resource-type | +---------------------+ As a user of a project, I can see resource types associated to private namespaces I don't have access to: ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ cat alicerc export OS_CACERT= export OS_PROJECT_NAME=separate export OS_USERNAME=alice export OS_PASSWORD=password export OS_REGION_NAME=RegionOne export OS_IDENTITY_API_VERSION=3 export OS_AUTH_TYPE=password export OS_AUTH_URL=http://192.168.1.155/identity export OS_USER_DOMAIN_ID=default export OS_PROJECT_DOMAIN_ID=default export OS_VOLUME_API_VERSION=3 ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ source alicerc ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-namespace-list +------------------------------------------+ | namespace | +------------------------------------------+ | OS::Software::DBMS | | CIM::ResourceAllocationSettingData | | OS::Compute::CPUPinning | | OS::Compute::Watchdog | | OS::Compute::GuestMemoryBacking | | OS::Compute::AggregateDiskFilter | | OS::Compute::RandomNumberGenerator | | OS::Compute::Hypervisor | | OS::Compute::AggregateIoOpsFilter | | OS::Compute::VirtCPUTopology | | OS::Compute::HostCapabilities | | CIM::ProcessorAllocationSettingData | | OS::Compute::GuestShutdownBehavior | | OS::Cinder::Volumetype | | OS::Software::WebServers | | OS::Compute::Libvirt | | OS::Compute::XenAPI | | OS::Compute::Quota | | OS::Compute::VMwareFlavor | | OS::Compute::VMwareQuotaFlavor | | OS::Compute::InstanceData | | OS::Compute::LibvirtImage | | OS::Compute::AggregateNumInstancesFilter | | OS::Glance::Signatures | | CIM::VirtualSystemSettingData | | CIM::StorageAllocationSettingData | | OS::Software::Runtimes | | OS::Compute::VMware | +------------------------------------------+ ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-namespace-create alice-namespace +------------+----------------------------------+ | Property | Value | +------------+----------------------------------+ | created_at | 2021-02-25T15:55:55Z | | namespace | alice-namespace | | owner | 67f1495e5dc145abbfa7059c63c6eda2 | | protected | False | | schema | /v2/schemas/metadefs/namespace | | updated_at | 2021-02-25T15:55:55Z | | visibility | private | +------------+----------------------------------+ ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-resource-type-associate --name alice-resource-type alice-namespace +------------+----------------------+ | Property | Value | +------------+----------------------+ | created_at | 2021-02-25T15:57:29Z | | name | alice-resource-type | | updated_at | 2021-02-25T15:57:29Z | +------------+----------------------+ Now as a separate user ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ source openrc demo demo is_service_enabled:29: command not found: set +o xtrace WARNING: setting legacy OS_TENANT_NAME to support cli tools. ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-resource-type-list +---------------------+ | name | +---------------------+ | OS::Glance::Image | | OS::Cinder::Volume | | OS::Nova::Server | | OS::Nova::Aggregate | | OS::Nova::Flavor | | OS::Trove::Instance | | bar | | test | | alice-resource-type | +---------------------+
2021-03-09 14:55:36 Jeremy Stanley information type Private Security Public
2021-03-09 14:56:12 Jeremy Stanley summary Glance leaks resource types across namespaces [OSSN-0088] Glance leaks resource types across namespaces
2021-03-09 14:56:52 Jeremy Stanley ossa: status Incomplete Won't Fix
2021-03-09 14:57:27 Jeremy Stanley bug task added ossn
2021-03-09 14:58:57 Jeremy Stanley ossn: importance Undecided Critical
2021-03-09 14:59:04 Jeremy Stanley ossn: status New Fix Released
2021-03-09 14:59:28 Jeremy Stanley ossn: assignee Abhishek Kekane (abhishek-kekane)
2021-03-09 15:00:18 Jeremy Stanley tags security