Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 439
Alerts This Week
Warning Icon 1 439

Red Hat OpenStack 3.0 RHSA-2013:1525-01 Moderate: Glance Security Issue

red hat
Calendar Grey November 18, 2013
Dist Redhat Esm H88
Canonical has announced a significant security patch for its Kubernetes platform, rectifying vital vulnerabilities and concerns.
Updated openstack-glance packages that fix one security issue and several bugs are now available for Red Hat OpenStack 3.0

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Summary

The openstack-glance packages provide a service (code name Glance) that acts as a registry for virtual machine images.
A flaw was found in the Glance download_image policy enforcement for cached system images. When an image was previously cached by an authorized download, any authenticated user able to determine the image by its UUID could download that image, bypassing the download_image policy. Only setups making use of the download_image policy were affected. (CVE-2013-4428)
Red Hat would like to thank the OpenStack Project for reporting this issue. The OpenStack Project acknowledges Stuart McLaren from HP as the original reporter.
These updated openstack-glance packages have been upgraded to upstream version 2013.1.4, which provides a number of bug fixes over the previous version. (BZ#1021640)
All users of openstack-glance are advised to upgrade to these updated packages, which correct these issues. After installing the updated packages, the running Glance services must be manually restarted (using "service [service name] restart") for this update to take effect.

Topics%20covered

Topics Covered

security advisory Red Hat bug fix moderate threat OpenStack image policy OpenStack-Glance

References

https://access.redhat.com/security/cve/CVE-2013-4428 https://access.redhat.com/security/updates/classification/#moderate

Package List

OpenStack 3:
Source:
noarch: openstack-glance-2013.1.4-1.el6ost.noarch.rpm openstack-glance-doc-2013.1.4-1.el6ost.noarch.rpm python-glance-2013.1.4-1.el6ost.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package


Advisory ID: RHSA-2013:1525-01
Product: Red Hat OpenStack
Advisory URL: https://access.redhat.com/errata/RHSA-2013:1525.html
Issue date: 2013-11-18

Topic

Updated openstack-glance packages that fix one security issue and severalbugs are now available for Red Hat OpenStack 3.0.The Red Hat Security Response Team has rated this update as having moderatesecurity impact. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available from the CVE link inthe References section.

Topics%20covered

Topics Covered

security advisory Red Hat bug fix moderate threat OpenStack image policy OpenStack-Glance

Relevant Releases Architectures

OpenStack 3 - noarch

Bugs Fixed

1019572 - CVE-2013-4428 OpenStack Glance: image_download policy not enforced for cached images

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.