yahoo-eng-team team mailing list archive

[nikhil komawar <nikhil.komawar@xxxxxxxxxxxxx>]

- https://review.openstack.org/156553 (Juno)
- https://review.openstack.org/157067 (Juno)
- https://review.openstack.org/156493 (Kilo)
- https://review.openstack.org/122427 (Kilo)

** Also affects: glance/kilo
   Importance: Medium
     Assignee: Mike Fedosin (mfedosin)
       Status: Fix Released

** Changed in: glance/juno
       Status: In Progress => Fix Committed

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Glance.
https://bugs.launchpad.net/bugs/1371118

Title:
  [OSSA 2015-004] Image file stays in store if image has been deleted
  during upload (CVE-2014-9684)

Status in OpenStack Image Registry and Delivery Service (Glance):
  Fix Released
Status in Glance icehouse series:
  Invalid
Status in Glance juno series:
  Fix Committed
Status in Glance kilo series:
  Fix Released
Status in OpenStack Security Advisories:
  In Progress

Bug description:
  When I create a new task in v2 to upload an image, it creates the
  image record in db, sets status to "saving" and then begins the
  uploading.

  If the image is deleted by appropriate API call while its content is
  still being uploaded, an exception is raised and it is not handled in
  the API code. This leads to the fact that the uploaded image file
  stays in a storage and clogs it.

  File "/opt/stack/glance/glance/common/scripts/image_import/main.py", line 62, in _execute 
  uri)
  File "/opt/stack/glance/glance/common/scripts/image_import/main.py", line 95, in import_image
  new_image = image_repo.get(image_id)
  File "/opt/stack/glance/glance/api/authorization.py", line 106, in get
  image = self.image_repo.get(image_id)
  File "/opt/stack/glance/glance/domain/proxy.py", line 86, in get
  return self.helper.proxy(self.base.get(item_id))
  File "/opt/stack/glance/glance/api/policy.py", line 179, in get
  return super(ImageRepoProxy, self).get(image_id)
  File "/opt/stack/glance/glance/domain/proxy.py", line 86, in get
  return self.helper.proxy(self.base.get(item_id))
  File "/opt/stack/glance/glance/domain/proxy.py", line 86, in get
  return self.helper.proxy(self.base.get(item_id))
  File "/opt/stack/glance/glance/domain/proxy.py", line 86, in get 
  return self.helper.proxy(self.base.get(item_id))
  File "/opt/stack/glance/glance/db/__init__.py", line 72, in get raise exception.NotFound(msg)
  NotFound: No image found with ID e2285448-a56f-45b1-9e6e-216d2b304967

  This bug is very similar to
  https://bugs.launchpad.net/glance/+bug/1188532, but it relates to task
  mechanism in v2.

To manage notifications about this bug go to:
https://bugs.launchpad.net/glance/+bug/1371118/+subscriptions