OpenStack Security Advisory

  1. Bug #1482371
  2. Comment #7

Comment 7 for bug 1482371

Revision history for this message
Hemanth Makkapati (hemanth-makkapati) wrote : Re: Image status can be changed by passing header 'x-image-meta-status' with PUT operation using v1

Oh well! I didn't try uploading with v2. Good find, Stuart!

Also, mucking with my test environment further, I discovered that one can change created_at as well using the header 'x-image-meta-created_at'. I haven't tried doing the same with updated_at, deleted_at and deleted fields but I don't see anything that stops them from getting modified either. I will try it here in a bit.

A lot of it has to do with the whitelisting of headers here, https://github.com/openstack/glance/blob/master/glance/common/utils.py#L59-L70.

It appears that this was done very explicitly. Does anyone know what could be the reason for it?