OpenStack Compute (nova)

  1. Bug #1524274
  2. Comment #4

Comment 4 for bug 1524274

Revision history for this message
Nikola Đipanov (ndipanov) wrote : Re: Unprivileged api user can access host data using instance snapshot

This is very similar to https://bugs.launchpad.net/nova/+bug/1221190

The problematic line

https://github.com/openstack/nova/blob/b5890b3c36613919338f83c4f59225f424c99cb1/nova/virt/libvirt/driver.py#L1357

was introduced by this commit: https://review.openstack.org/#/c/13684/ which was merged more than 3 years ago, but looking at the surrounding code at the time, the problem was there even before the patch, since we'd just grab the image format from glance which is completely user controlled as well.

So this does not seem like a regression.