cinder backup-list is always listing all tenants's bug for admin in V1 api

[Cyril Feraudet]

https://bugs.launchpad.net/python-cinderclient/+bug/1422046 has been fixed for V2 only

This is a security issue cause it leads to deleting all production backups when logged as admin

[Jeremy Stanley (fungi)]

Since this report concerns a possible security risk, an incomplete security advisory task has been added while the core security reviewers for the affected project or projects confirm the bug and discuss the scope of any vulnerability along with potential solutions.

[Jeremy Stanley (fungi)]

While I agree there is a non-negligible risk presented by this behavior, I don't see how a malicious actor could use this flaw to their advantage. As such, it doesn't seem like something for which the OpenStack Vulnerability Management Team would issue an official security advisory.

[Yves-Gwenael Bourhis (yves-gwenael-bourhis)]

Just a class D issue: https://security.openstack.org/vmt-process.html#incident-report-taxonomy
Sorry for the noise

[Jeremy Stanley (fungi)]

As with related bug 1422046, I'm similarly triaging this as a security hardening opportunity (class D in our taxonomy https://security.openstack.org/vmt-process.html#incident-report-taxonomy ).

[Sean McGinnis (sean-mcginnis)]

As part of the v2 only fix mentioned, the service side in cinder was changed to only return the admin's own backups.

https://review.openstack.org/#/c/207451/

This effectively resolved this bug as it is no longer a risk that an admin could accidentally get and delete all tenant's backups.

Without a change to the v1 support of the client, the admin no longer has the ability to get all backups in the system. As v1 has been deprecated for some time and we are trying to get folks to move over to v2 this is fine. This should encourage admins that do need to get all backups to use the v2 API.

[Steve Martinelli (stevemar)]

As far as i can tell, this was fixed by bug 1422046, and new versions of cinderclient should fix this in ospurge