| 2017-10-18 14:55:52 |
Yves-Gwenael Bourhis |
bug |
|
|
added bug |
| 2017-10-18 14:55:52 |
Yves-Gwenael Bourhis |
attachment added |
|
Proposed fix https://bugs.launchpad.net/bugs/1724598/+attachment/4974910/+files/fix_swift_limits.patch |
|
| 2017-10-18 15:10:29 |
Yves-Gwenael Bourhis |
bug |
|
|
added subscriber Rob Cresswell |
| 2017-10-18 15:13:28 |
Yves-Gwenael Bourhis |
bug |
|
|
added subscriber Elvis Tombini |
| 2017-10-18 15:17:29 |
Yves-Gwenael Bourhis |
bug |
|
|
added subscriber Nolwenn Cauchois |
| 2017-10-18 15:17:47 |
Yves-Gwenael Bourhis |
bug |
|
|
added subscriber Guillaume Espanel |
| 2017-10-18 15:24:52 |
Yves-Gwenael Bourhis |
bug |
|
|
added subscriber David Lyle |
| 2017-10-18 15:25:04 |
Yves-Gwenael Bourhis |
bug |
|
|
added subscriber Akihiro Motoki |
| 2017-10-18 15:25:27 |
Yves-Gwenael Bourhis |
bug |
|
|
added subscriber Radomir Dopieralski |
| 2017-10-18 15:26:40 |
Yves-Gwenael Bourhis |
bug |
|
|
added subscriber Tatiana Ovchinnikova |
| 2017-10-18 15:26:54 |
Yves-Gwenael Bourhis |
bug |
|
|
added subscriber Ying Zuo |
| 2017-10-18 15:27:11 |
Yves-Gwenael Bourhis |
bug |
|
|
added subscriber Kenji Ishii |
| 2017-10-18 15:29:18 |
Yves-Gwenael Bourhis |
removed subscriber Kenji Ishii |
|
|
|
| 2017-10-18 15:29:24 |
Yves-Gwenael Bourhis |
removed subscriber Ying Zuo |
|
|
|
| 2017-10-18 15:29:27 |
Yves-Gwenael Bourhis |
removed subscriber Tatiana Ovchinnikova |
|
|
|
| 2017-10-18 15:29:30 |
Yves-Gwenael Bourhis |
removed subscriber Radomir Dopieralski |
|
|
|
| 2017-10-18 15:29:32 |
Yves-Gwenael Bourhis |
removed subscriber Akihiro Motoki |
|
|
|
| 2017-10-18 15:29:35 |
Yves-Gwenael Bourhis |
removed subscriber David Lyle |
|
|
|
| 2017-10-18 15:40:26 |
Jeremy Stanley |
bug task added |
|
ossa |
|
| 2017-10-18 15:41:13 |
Jeremy Stanley |
ossa: status |
New |
Incomplete |
|
| 2017-10-18 15:41:39 |
Jeremy Stanley |
description |
A user can make the horizon apache process crash.
Indeed, API_RESULT_LIMIT does not work when `full_listing=False` is passed as argument to swiftclient.client.Connection.get_account or to swiftclient.client.Connection.get_container
Therefore When a customer has a very large amount of objects, the full production server crashes and stops responding.
To reproduce : slowly upload a million small objects on one container, then view this container : The server crashes. |
This issue is being treated as a potential security risk under embargo. Please do not make any public mention of embargoed (private) security vulnerabilities before their coordinated publication by the OpenStack Vulnerability Management Team in the form of an official OpenStack Security Advisory. This includes discussion of the bug or associated fixes in public forums such as mailing lists, code review systems and bug trackers. Please also avoid private disclosure to other individuals not already approved for access to this information, and provide this same reminder to those who are made aware of the issue prior to publication. All discussion should remain confined to this private bug report, and any proposed fixes should be added to the bug as attachments.
A user can make the horizon apache process crash.
Indeed, API_RESULT_LIMIT does not work when `full_listing=False` is passed as argument to swiftclient.client.Connection.get_account or to swiftclient.client.Connection.get_container
Therefore When a customer has a very large amount of objects, the full production server crashes and stops responding.
To reproduce : slowly upload a million small objects on one container, then view this container : The server crashes. |
|
| 2017-10-18 15:41:56 |
Jeremy Stanley |
bug |
|
|
added subscriber Horizon Core security contacts |
| 2017-10-18 15:54:23 |
Yves-Gwenael Bourhis |
bug |
|
|
added subscriber Ala Rezmerita |
| 2017-10-18 15:57:57 |
Yves-Gwenael Bourhis |
bug |
|
|
added subscriber Xavier Maillard |
| 2017-11-03 09:34:53 |
Yves-Gwenael Bourhis |
attachment added |
|
fix_swift_limits.patch https://bugs.launchpad.net/horizon/+bug/1724598/+attachment/5002891/+files/fix_swift_limits.patch |
|
| 2020-02-27 23:40:21 |
Jeremy Stanley |
description |
This issue is being treated as a potential security risk under embargo. Please do not make any public mention of embargoed (private) security vulnerabilities before their coordinated publication by the OpenStack Vulnerability Management Team in the form of an official OpenStack Security Advisory. This includes discussion of the bug or associated fixes in public forums such as mailing lists, code review systems and bug trackers. Please also avoid private disclosure to other individuals not already approved for access to this information, and provide this same reminder to those who are made aware of the issue prior to publication. All discussion should remain confined to this private bug report, and any proposed fixes should be added to the bug as attachments.
A user can make the horizon apache process crash.
Indeed, API_RESULT_LIMIT does not work when `full_listing=False` is passed as argument to swiftclient.client.Connection.get_account or to swiftclient.client.Connection.get_container
Therefore When a customer has a very large amount of objects, the full production server crashes and stops responding.
To reproduce : slowly upload a million small objects on one container, then view this container : The server crashes. |
This issue is being treated as a potential security risk under
embargo. Please do not make any public mention of embargoed
(private) security vulnerabilities before their coordinated
publication by the OpenStack Vulnerability Management Team in the
form of an official OpenStack Security Advisory. This includes
discussion of the bug or associated fixes in public forums such as
mailing lists, code review systems and bug trackers. Please also
avoid private disclosure to other individuals not already approved
for access to this information, and provide this same reminder to
those who are made aware of the issue prior to publication. All
discussion should remain confined to this private bug report, and
any proposed fixes should be added to the bug as attachments. This
embargo shall not extend past 2020-05-27 and will be made
public by or on that date if no fix is identified.
A user can make the horizon apache process crash.
Indeed, API_RESULT_LIMIT does not work when `full_listing=False` is passed as argument to swiftclient.client.Connection.get_account or to swiftclient.client.Connection.get_container
Therefore When a customer has a very large amount of objects, the full production server crashes and stops responding.
To reproduce : slowly upload a million small objects on one container, then view this container : The server crashes. |
|
| 2020-05-19 18:11:23 |
Jeremy Stanley |
description |
This issue is being treated as a potential security risk under
embargo. Please do not make any public mention of embargoed
(private) security vulnerabilities before their coordinated
publication by the OpenStack Vulnerability Management Team in the
form of an official OpenStack Security Advisory. This includes
discussion of the bug or associated fixes in public forums such as
mailing lists, code review systems and bug trackers. Please also
avoid private disclosure to other individuals not already approved
for access to this information, and provide this same reminder to
those who are made aware of the issue prior to publication. All
discussion should remain confined to this private bug report, and
any proposed fixes should be added to the bug as attachments. This
embargo shall not extend past 2020-05-27 and will be made
public by or on that date if no fix is identified.
A user can make the horizon apache process crash.
Indeed, API_RESULT_LIMIT does not work when `full_listing=False` is passed as argument to swiftclient.client.Connection.get_account or to swiftclient.client.Connection.get_container
Therefore When a customer has a very large amount of objects, the full production server crashes and stops responding.
To reproduce : slowly upload a million small objects on one container, then view this container : The server crashes. |
This issue is being treated as a potential security risk under
embargo. Please do not make any public mention of embargoed
(private) security vulnerabilities before their coordinated
publication by the OpenStack Vulnerability Management Team in the
form of an official OpenStack Security Advisory. This includes
discussion of the bug or associated fixes in public forums such as
mailing lists, code review systems and bug trackers. Please also
avoid private disclosure to other individuals not already approved
for access to this information, and provide this same reminder to
those who are made aware of the issue prior to publication. All
discussion should remain confined to this private bug report, and
any proposed fixes should be added to the bug as attachments. This
embargo shall not extend past 2020-05-27 and will be made
public by or on that date even if no fix is identified.
A user can make the horizon apache process crash.
Indeed, API_RESULT_LIMIT does not work when `full_listing=False` is passed as argument to swiftclient.client.Connection.get_account or to swiftclient.client.Connection.get_container
Therefore When a customer has a very large amount of objects, the full production server crashes and stops responding.
To reproduce : slowly upload a million small objects on one container, then view this container : The server crashes. |
|
| 2020-05-27 15:57:52 |
Jeremy Stanley |
description |
This issue is being treated as a potential security risk under
embargo. Please do not make any public mention of embargoed
(private) security vulnerabilities before their coordinated
publication by the OpenStack Vulnerability Management Team in the
form of an official OpenStack Security Advisory. This includes
discussion of the bug or associated fixes in public forums such as
mailing lists, code review systems and bug trackers. Please also
avoid private disclosure to other individuals not already approved
for access to this information, and provide this same reminder to
those who are made aware of the issue prior to publication. All
discussion should remain confined to this private bug report, and
any proposed fixes should be added to the bug as attachments. This
embargo shall not extend past 2020-05-27 and will be made
public by or on that date even if no fix is identified.
A user can make the horizon apache process crash.
Indeed, API_RESULT_LIMIT does not work when `full_listing=False` is passed as argument to swiftclient.client.Connection.get_account or to swiftclient.client.Connection.get_container
Therefore When a customer has a very large amount of objects, the full production server crashes and stops responding.
To reproduce : slowly upload a million small objects on one container, then view this container : The server crashes. |
A user can make the horizon apache process crash.
Indeed, API_RESULT_LIMIT does not work when `full_listing=False` is passed as argument to swiftclient.client.Connection.get_account or to swiftclient.client.Connection.get_container
Therefore When a customer has a very large amount of objects, the full production server crashes and stops responding.
To reproduce : slowly upload a million small objects on one container, then view this container : The server crashes. |
|
| 2020-05-27 15:57:59 |
Jeremy Stanley |
information type |
Private Security |
Public Security |
|
| 2021-05-10 17:38:37 |
OpenStack Infra |
horizon: status |
New |
In Progress |
|
| 2021-07-01 12:18:13 |
Christian Rohmann |
bug |
|
|
added subscriber Christian Rohmann |
| 2023-06-01 19:01:35 |
Jeremy Stanley |
ossa: status |
Incomplete |
Won't Fix |
|
| 2023-06-01 19:04:54 |
Jeremy Stanley |
information type |
Public Security |
Public |
|
| 2023-06-01 19:05:03 |
Jeremy Stanley |
tags |
|
security |
|
