It is because we don't validate the actual content of the "image-stream" field, we just tack it into the lookup string. And ".released" is not in the lookup string, but ".daily" is. (but we wouldn't complain if you put
image-stream: "quijybo"
It would just happily look for com.ubuntu.cloud-image.quijybo:12.04
It is because we don't validate the actual content of the "image-stream" field, we just tack it into the lookup string. And ".released" is not in the lookup string, but ".daily" is. (but we wouldn't complain if you put cloud-image. quijybo: 12.04
image-stream: "quijybo"
It would just happily look for com.ubuntu.
I think we knock this down from Critical.