bugbot adjusting priority

CRD: 2016-10-27

Public at https://wiki.openstack.org/wiki/OSSN/OSSN-0076

Glance Image service v1 and v2 api image-create vulnerability

Summary: No limits are enforced within the Glance image service for both v1 and v2 `/images` API POST method for authenticated users, resulting in possible denial of service attacks through database table saturation.
Affected Services / Software

All versions of Glance image service.

Discussion: Within the Glance image service, calls to the POST method within v1 or v2/images creates an image (record) in `queued` status. There is no limit enforced within the Glance API on the number of images a single tenant may create, just on the total amount of storage a single user may consume.

Therefore a user could either maliciously or unintentionally fill multiple database tables (images, image_properties, image_tags, image_members) with useless image records, thereby causing a denial of service by lengthening transaction response times in the Glance database.

Recommended Actions: For all versions of Glance that expose either the v1 and v2/images API, operators are recommended to deploy external rate-limiting proxies or web application firewalls, to provide a front layer of protection to glance. The Glance database should be monitored for abnormal growth. Although rate-limiting does not eliminate this attack vector, it will slow it to the point where you can react prior to a denial of service occurring.

The following solutions may be considered, however it is key that the operator carefully plans and considers the individual performance needs of users and services within their OpenStack cloud, when configuring any rate limiting functionality.

Repose: Repose provides a rate limiting filter, that can utilise limits by IP, Role (OpenStack Identity v3 filter) or header.

https://repose.atlassian.net/wiki/display/REPOSE/Rate+Limiting+Filter

NGINX: NGINX provides the limit_req_module, which can be used to provide a global rate limit. By means of a `map`, it can be limited to just the POST method.

Further details can be found on the nginx site: http://nginx.org/en/docs/http/ngx_http_limit_req_module.html

HAProxy: HAProxy can provide inherent rate-limiting using stick-tables with a General Purpose Counter (gpc)

Further details can be found on the haproxy website:

http://blog.haproxy.com/2012/02/27/use-a-load-balancer-as-a-first-row-of-defense-against-ddos

Apache: A number of solutions can be explored here as follows.

mod_ratelimit http://httpd.apache.org/docs/2.4/mod/mod_ratelimit.html
mod_qos http://opensource.adnovum.ch/mod_qos/dos.html
mod_evasive  https://www.digitalocean.com/community/tutorials/how-to-protect-against-dos-and-ddos-with-mod_evasive-for-apache-on-centos-7
mod_security https://www.modsecurity.org/

Limit `add_image` to admin role

Another possible mitigation is to restrict image creation to the admin role, however this should only be done for those cases in which there are Glance nodes dedicated to end-user access only. Restriction to admin only on Glance nodes that serve OpenStack services will for example, remove the ability to create snapshots from the Compute API or to create bootable volumes from Cinder.

To restrict image creation to the role admin only, amend `/etc/glance/policy.json` accordingly.

   "add_image": "role:admin",

Contacts / References

Author: Luke Hinds, Red Hat

This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0076

Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1545092

OpenStack Security ML : openstack-security@lists.openstack.org

OpenStack Security Group : https://launchpad.net/~openstack-ossg

Rick, Vincent, what do we do with this now. Is this a documentation bug to add steps?

(In reply to Keith Berger from comment #11)
> Rick, Vincent, what do we do with this now. Is this a documentation bug to
> add steps?

No, we need a patch like https://github.com/crowbar/crowbar-openstack/pull/1378

https://github.com/crowbar/crowbar-openstack/pull/1677

Adding a patch to Ardana 

https://gerrit.suse.provo.cloud/4357 

I will send this back to the Security team once the patch is merged

After doing lots of research and testing, the root problem in my patch is all of the docs showing you how to do rate limiting with haproxy, it assumes it is running in "http" mode. In CLM we use tcp mode be default. some use http like horizon so I am testing http mode now for glance

The patch has been merged.


==== ardana-input-model ====
Version update (8.0+git.1530100660.7e77a0c -> 8.0+git.1533855233.4496443)

- Update to version 8.0+git.1533855233.4496443:
  * Add glance-api rate limit to address CVE-2016-8611 (bsc#1005886)

SUSE-SU-2018:2603-1: An update that solves two vulnerabilities and has 6 fixes is now available.

Category: security (moderate)
Bug References: 1005886,1073703,1081518,1083093,1093898,1096759,1098369,1103383
CVE References: CVE-2016-8611,CVE-2018-3760
Sources used:
SUSE OpenStack Cloud 7 (src):    crowbar-4.0+git.1528801103.f5708341-7.20.1, crowbar-core-4.0+git.1534246408.3ab19c567-9.33.1, crowbar-ha-4.0+git.1533750802.5768e73-4.34.1, crowbar-openstack-4.0+git.1534254269.ce598a9fe-9.39.1, crowbar-ui-1.1.0+git.1533844061.4ac8e723-4.3.1
SUSE Enterprise Storage 4 (src):    crowbar-4.0+git.1528801103.f5708341-7.20.1, crowbar-core-4.0+git.1534246408.3ab19c567-9.33.1

@Keith 

Patch https://gerrit.suse.provo.cloud/#/c/4357/ is not included in MU 8359, You can check hlm002

Jenny, 

Thanks let me track this down.

Per Vaclav:

This change is present on the updated system:

https://github.com/crowbar/crowbar-openstack/pull/1378/files

So for Crowbar-based SOC, we can consider this bug as fixed.

close now

SUSE-SU-2018:2762-1: An update that solves two vulnerabilities and has 9 fixes is now available.

Category: security (moderate)
Bug References: 1005886,1073703,1081518,1083093,1090336,1093898,1095420,1096043,1096759,1098369,1099392
CVE References: CVE-2016-8611,CVE-2018-3760
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    crowbar-5.0+git.1528696845.81a7b5d0-3.3.1, crowbar-core-5.0+git.1533887407.6e9b0412d-3.8.2, crowbar-ha-5.0+git.1530177874.35b9099-3.3.1, crowbar-init-5.0+git.1520420379.d5bbb35-3.3.1, crowbar-openstack-5.0+git.1534167599.d325ef804-4.8.2, crowbar-ui-1.2.0+git.1533844061.4ac8e723-3.3.1

is this resolved yet

yes

Verified in hlm007

SUSE-RU-2018:3638-1: An update that solves one vulnerability and has 22 fixes is now available.

Category: recommended (moderate)
Bug References: 1005886,1049737,1082708,1089243,1091490,1094847,1095166,1096798,1096988,1097241,1099412,1099741,1100688,1102662,1102789,1103903,1104047,1104407,1105141,1105420,1109264,1109445,1111886
CVE References: CVE-2016-8611
Sources used:
SUSE OpenStack Cloud 8 (src):    ardana-ansible-8.0+git.1539739656.0ef51c9-3.46.1, ardana-barbican-8.0+git.1534266594.8136db7-4.27.2, ardana-cinder-8.0+git.1535412193.d9ad231-3.27.2, ardana-cluster-8.0+git.1534266734.ec4822f-3.30.2, ardana-cobbler-8.0+git.1534780521.780753b-3.29.2, ardana-freezer-8.0+git.1534266805.c9ea29b-3.12.2, ardana-glance-8.0+git.1537790499.b15fdea-3.8.2, ardana-input-model-8.0+git.1539086744.5ae1d6f-3.21.2, ardana-keystone-8.0+git.1536100286.ddd8d3e-3.15.2, ardana-mq-8.0+git.1534267034.f95e1ec-3.5.2, ardana-neutron-8.0+git.1537805998.7898f24-3.21.2, ardana-nova-8.0+git.1537895345.35a03a2-3.14.2, ardana-octavia-8.0+git.1534267086.b7dbe77-3.8.2, ardana-osconfig-8.0+git.1540330973.aab0174-3.27.1, ardana-service-8.0+git.1537825617.23552c2-3.14.2, ardana-service-ansible-8.0+git.1537806377.25b5d68-3.11.2, ardana-ses-8.0+git.1539113493.6631423-1.8.2, ardana-swift-8.0+git.1534267211.78fb7e3-3.18.2
HPE Helion Openstack 8 (src):    ardana-ansible-8.0+git.1539739656.0ef51c9-3.46.1, ardana-barbican-8.0+git.1534266594.8136db7-4.27.2, ardana-cinder-8.0+git.1535412193.d9ad231-3.27.2, ardana-cluster-8.0+git.1534266734.ec4822f-3.30.2, ardana-cobbler-8.0+git.1534780521.780753b-3.29.2, ardana-freezer-8.0+git.1534266805.c9ea29b-3.12.2, ardana-glance-8.0+git.1537790499.b15fdea-3.8.2, ardana-input-model-8.0+git.1539086744.5ae1d6f-3.21.2, ardana-keystone-8.0+git.1536100286.ddd8d3e-3.15.2, ardana-mq-8.0+git.1534267034.f95e1ec-3.5.2, ardana-neutron-8.0+git.1537805998.7898f24-3.21.2, ardana-nova-8.0+git.1537895345.35a03a2-3.14.2, ardana-octavia-8.0+git.1534267086.b7dbe77-3.8.2, ardana-osconfig-8.0+git.1540330973.aab0174-3.27.1, ardana-service-8.0+git.1537825617.23552c2-3.14.2, ardana-service-ansible-8.0+git.1537806377.25b5d68-3.11.2, ardana-ses-8.0+git.1539113493.6631423-1.8.2, ardana-swift-8.0+git.1534267211.78fb7e3-3.18.2

Done

SUSE-SU-2020:3624-1: An update that fixes 5 vulnerabilities, contains one feature is now available.

Category: security (moderate)
Bug References: 1005886,1170479,1177120,1178243,1178988
CVE References: CVE-2016-8611,CVE-2019-20933,CVE-2019-9740,CVE-2020-24303,CVE-2020-26137
JIRA References: SOC-11240
Sources used:
SUSE OpenStack Cloud 7 (src):    crowbar-openstack-4.0+git.1604938545.30c10db18-9.77.1, grafana-6.7.4-1.20.1, influxdb-1.2.4-5.1, python-urllib3-1.16-3.12.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.