yahoo-eng-team team mailing list archive

Thread
Date

[Bug 1252459] Re: Glance needs a config option to limit the number of image members

To: yahoo-eng-team@xxxxxxxxxxxxxxxxxxx
From: Thierry Carrez <thierry.carrez+lp@xxxxxxxxx>
Date: Wed, 04 Dec 2013 14:54:34 -0000
Reply-to: Bug 1252459 <1252459@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx

** Changed in: glance
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Glance.
https://bugs.launchpad.net/bugs/1252459

Title:
  Glance needs a config option to limit the number of image members

Status in OpenStack Image Registry and Delivery Service (Glance):
  Fix Released

Bug description:
  Glance v2 allows users to put "members" on an image. There is no limit
  to the number of image members.

  This is a (linear) DoS attack vector.

  The fix for this should be done similar to the fix for
  https://bugs.launchpad.net/glance/+bug/1251518 to keep configuration
  consistent.

To manage notifications about this bug go to:
https://bugs.launchpad.net/glance/+bug/1252459/+subscriptions