8c43caaefd
Fixed Server-Side Request Forgery (SSRF) vulnerabilities in Glance's image import functionality that could allow attackers to bypass URL validation and access internal resources. The fix includes: - IP address validation using Python's ipaddress module to reject encoded IP formats (decimal, hexadecimal, octal) that could bypass blacklist checks - HTTP redirect validation for web-download, glance-download, and OVF processing to prevent redirect-based SSRF attacks - URI validation for OVF processing which previously had no protection The implementation uses Python's built-in ipaddress module which inherently rejects all non-standard IP encodings and only accepts standard formats, providing robust protection against IP encoding bypass attacks. Depends-On: https://review.opendev.org/c/openstack/tempest/+/981329 Assisted-by: Used Cursor (Auto) for unit tests. Closes-Bug: #2138602 Closes-Bug: #2138672 Closes-Bug: #2138675 SecurityImpact Change-Id: Ib8d337dc68411d18c70d5712cc4f0986ef6205f4 Signed-off-by: Abhishek Kekane <[email protected]>
OpenStack Glance
Glance is an OpenStack project that provides services and associated libraries to store, browse, share, distribute and manage bootable disk images, other data closely associated with initializing compute resources, and metadata definitions.
Use the following resources to learn more:
API
To learn how to use Glance's API, consult the documentation available online at:
Developers
For information on how to contribute to Glance, please see the contents of the CONTRIBUTING.rst in this repository.
Any new code must follow the development guidelines detailed in the HACKING.rst file, and pass all unit tests.
Further developer focused documentation is available at:
Operators
To learn how to deploy and configure OpenStack Glance, consult the documentation available online at:
In the unfortunate event that bugs are discovered, they should be reported to the appropriate bug tracker. You can raise bugs here:
Release notes
To learn more about Glance's new features, optimizations, and changes between versions, consult the release notes online at:
Other Information
During each design summit, we agree on what the whole community wants to focus on for the upcoming release. You can see image service plans:
For more information about the Glance project please see: