2025.1 Series Release Notes

30.1.0-3

Security Issues

  • Fixed multiple Server-Side Request Forgery (SSRF) vulnerabilities in Glance’s image import functionality. These vulnerabilities could allow attackers to bypass URL validation and access internal resources.

    web-download Import Method SSRF:

    The web-download import method had two SSRF vulnerabilities:

    HTTP Redirect Bypass: The web-download import method did not validate redirect destinations when following HTTP redirects. An attacker could provide an initial URL that passed validation, but redirect to an internal or disallowed resource that would bypass the security checks. This has been fixed by implementing SafeRedirectHandler that validates redirect destinations before following them using the same validate_import_uri() checks as the initial URL.

    IP Address Encoding Bypass: The web-download import method’s URL validation could be bypassed by encoding IP addresses in alternative formats (decimal integer, hexadecimal, octal). For example, 127.0.0.1 could be encoded as 2130706433 (decimal) or 0x7f000001 (hexadecimal) to bypass blacklist checks. This has been fixed by implementing normalize_hostname() function that uses Python’s ipaddress module to validate IP addresses. The ipaddress module only accepts standard dotted-decimal notation for IPv4 and standard format for IPv6, automatically rejecting all encoded formats (decimal, hexadecimal, octal). Any attempt to use encoded IP formats is rejected, preventing SSRF bypass attacks.

    glance-download Import Method SSRF:

    The glance-download import method had redirect validation bypass vulnerabilities in two steps of the import flow:

    Image Data Download: When downloading image data from a remote Glance endpoint, redirects were not validated, allowing attackers to redirect to internal services.

    Metadata Fetch: When fetching image metadata from a remote Glance endpoint, redirects were not validated, allowing attackers to redirect to internal services.

    Both steps have been fixed by using SafeRedirectHandler to validate redirect destinations before following them.

    OVF Processing SSRF:

    The OVF processing functionality had a critical SSRF vulnerability with zero protection - no URI validation, no redirect validation, and no IP normalization. The code directly called urllib.request.urlopen(uri) without any validation checks. This has been fixed by adding URI validation using validate_import_uri() and redirect validation using SafeRedirectHandler.

    Affected Components:

    • glance.common.scripts.utils.get_image_data_iter()

    • glance.common.utils.validate_import_uri()

    • glance.async_.flows._internal_plugins.glance_download._DownloadGlanceImage.execute()

    • glance.async_.flows.api_image_import._ImportMetadata.execute()

    • glance.async_.flows.ovf_process._OVF_Process._get_ova_iter_objects()

    Impact:

    • Severity: High (web-download, glance-download), Critical (OVF processing)

    • Affected Versions: All versions prior to this fix

    • Workaround: Administrators can temporarily disable affected import methods by removing them from the enabled_import_methods configuration option

    Bugs #2138602, #2138672, #2138675

Bug Fixes

  • Bug 2138602: Fixed SSRF vulnerability in web-download import method via HTTP redirect bypass and IP address encoding bypass. Added redirect validation using SafeRedirectHandler and IP address validation using Python’s ipaddress module to reject encoded IP formats and prevent bypass attacks.

    Bug 2138672: Fixed SSRF vulnerability in glance-download import method via HTTP redirect bypass. Added redirect validation for both image data download and metadata fetch operations.

    Bug 2138675: Fixed SSRF vulnerability in OVF processing functionality which lacked URI validation. Added URI validation and redirect validation to prevent SSRF attacks when processing OVA files.

30.0.0

New Features

  • A new file, glance/wsgi/api.py, has been added as a place to hold a WSGI application object. This is intended to ease deployment by providing a consistent location for these objects. For example, if using uWSGI then instead of:

    [uwsgi]
wsgi-file = /bin/glance-wsgi-api

    You can now use:

    [uwsgi]
module = glance.wsgi.api:application

    This also simplifies deployment with other WSGI servers that expect module paths such as gunicorn.

  • Glance now inspects image content on upload and import, checking format adherence with the declared disk_format and running safety checks on content it recognises. The new config knob [image_format]/require_image_format_match controls whether or not images are rejected when the format set on image creation does not match the content that is uploaded. Some images that are currently treated as raw may trigger safety check failures when examining the MBR record (or what Glance thinks is an MBR). These may be legit failures (due to proliferation of GPT images with invalid Protective MBR structures) as well as other content that attempts to be PC-BIOS-Bootable and thus have a quasi-MBR structure ahead of the payload, which may not be fully compliant. Thus, a new config knob [image_format]/gpt_safety_checks_nonfatal is added to (by default) allow these failures to be non-fatal.

Upgrade Notes

  • The stores_info_detail policy has deprecated the rule rule:context_is_admin in favour of rule:context_is_admin AND service_roles:service to allow service to service interaction.

  • Glance will check that uploaded content matches disk_format by default, so operators should be on the lookout for any false positives and be ready for reports of upload failures if users are currently not properly representing their uploads.

  • Support for Python 3.8 has been removed. Now the minimum Python version supported is 3.9.

  • Support for running Glance services in Windows operating systems has been removed.

Deprecation Notes

  • The stores_info_detail policy has deprecated the rule rule:context_is_admin in favour of rule:context_is_admin AND service_roles:service to allow service to service interaction.

Bug Fixes

  • Bug 2081009: oslo_config.cfg.NotInitializedError when switching default policy_file in oslo.policy

  • Bug 2086675: Suspected performance regression for RBD back end linked to location sorting

Other Notes

  • Updated the stores detail API response to include fsid field in RBD store properties.