OpenStack Security Advisory

  1. Bug #1482371
  2. Comment #22

Comment 22 for bug 1482371

Revision history for this message
Erno Kuvaja (jokke) wrote : Re: Image status can be changed by passing header 'x-image-meta-status' with PUT operation using v1

Hi Grant,

Thanks for that. As Stuart pointed out on comment #6 it would be also possible to upload replacement data utilizing v2 API after the initial status change over v1 API. This would break the immutability promise we have.

Rest, please correct me, but this issue was only affecting images owned by tenant (and admins), right? One couldn't alter images they did not own.