OpenStack Security Advisory

  1. Bug #1482371
  2. Comment #14

Comment 14 for bug 1482371

Revision history for this message
Stuart McLaren (stuart-mclaren) wrote : Re: Image status can be changed by passing header 'x-image-meta-status' with PUT operation using v1

However, we get a '400' in the case of an invalid status -- we should probably try not to change this.

$ curl -v -X PUT http://127.0.0.1:9292/v1/images/eda41b92-a79f-46d1-8248-dfcb5e9227ae -H 'X-Auth-Token: 7535a1be77e3459e8e4928aae02a8042' -H 'x-image-meta-id: 1234' -H 'x-image-meta-status: huh'
* Hostname was NOT found in DNS cache
* Trying 127.0.0.1...
* Connected to 127.0.0.1 (127.0.0.1) port 9292 (#0)
> PUT /v1/images/eda41b92-a79f-46d1-8248-dfcb5e9227ae HTTP/1.1
> User-Agent: curl/7.35.0
> Host: 127.0.0.1:9292
> Accept: */*
> X-Auth-Token: 7535a1be77e3459e8e4928aae02a8042
> x-image-meta-id: 1234
> x-image-meta-status: huh
>
 < HTTP/1.1 400 Bad Request
< Content-Length: 370
< Content-Type: text/html; charset=UTF-8
< X-Openstack-Request-Id: req-req-0a5b4e62-325e-4add-a5aa-1863eb3b5a95
< Date: Mon, 10 Aug 2015 17:43:29 GMT
<
<html>
 <head>
  <title>400 Bad Request</title>
 </head>
 <body>
  <h1>400 Bad Request</h1>
  Failed to update image metadata. Got error: 400 Bad Request

The server could not comply with the request since it is either malformed or otherwise incorrect.

 Failed to update image metadata. Got error: Invalid image status 'huh' for image. <br /><br />