Current Series Release Notes

32.0.0.0rc1-39

New Features

  • The image download endpoint GET /v2/images/{image_id}/file now supports store preference using query parameters. This allows services like Nova and Cinder to suggest which stores to try when downloading images, enabling them to prefer stores that are close to them or have better performance characteristics.

    A new query parameter is available:

    • prefer: A comma-separated list of store identifiers suggesting the ordering of stores to try when downloading the image. Store identifiers are site-specific and can be discovered using the GET /v2/info/stores endpoint.

      Glance will try stores from the list in order. If the image is not found in any of the specified stores, the system will fall back to the default behavior (trying all stores).

    Note

    Store preference parameters only apply when fetching images from backend stores, not when serving from cache. Cached images bypass the store preference logic entirely.

    A new policy rule download_from_store controls who can use store preference parameters when downloading images. By default, anyone who can download images can also use store preference. Deployers can restrict this policy if needed.

  • Added a new cache API endpoint, GET /v2/cache/nodes/{image_id}, to list the node reference URLs where an image is cached when using the centralized_db cache driver.

Upgrade Notes

  • This feature is backward compatible. If no query parameters are provided, the endpoint behaves exactly as before, using the default store ordering logic.

    The new download_from_store policy rule is available for deployers who want to restrict store preference to specific users or roles. By default, the policy allows anyone who can download images to also use store preference. See the policies documentation for more information on configuring policies.

    Note

    Store preference requires multiple stores to be configured via the enabled_backends configuration option. If multiple stores are not configured, store preference parameters will be rejected with a 400 (Bad Request) response.

  • Python 3.10 support has been dropped. The minimum version of Python now supported is Python 3.11.

  • Glance now defaults to performing all the GPT/MBR safety checks on those images. Previously we defaulted to making MBR checks non-fatal because of some wild-found images with data in the MBR that violates the GPT spec. When we added the nonfatal list and the default, we noted that we would leave it in place for at least one cycle and then set the default back to strict. That has now been done. If operators have images that still have invalid GPT/PMBR data, those should be fixed as glance will reject them.

Security Issues

  • Fixed multiple Server-Side Request Forgery (SSRF) vulnerabilities in Glance’s image import functionality. These vulnerabilities could allow attackers to bypass URL validation and access internal resources.

    web-download Import Method SSRF:

    The web-download import method had two SSRF vulnerabilities:

    HTTP Redirect Bypass: The web-download import method did not validate redirect destinations when following HTTP redirects. An attacker could provide an initial URL that passed validation, but redirect to an internal or disallowed resource that would bypass the security checks. This has been fixed by implementing SafeRedirectHandler that validates redirect destinations before following them using the same validate_import_uri() checks as the initial URL.

    IP Address Encoding Bypass: The web-download import method’s URL validation could be bypassed by encoding IP addresses in alternative formats (decimal integer, hexadecimal, octal). For example, 127.0.0.1 could be encoded as 2130706433 (decimal) or 0x7f000001 (hexadecimal) to bypass blacklist checks. This has been fixed by implementing normalize_hostname() function that uses Python’s ipaddress module to validate IP addresses. The ipaddress module only accepts standard dotted-decimal notation for IPv4 and standard format for IPv6, automatically rejecting all encoded formats (decimal, hexadecimal, octal). Any attempt to use encoded IP formats is rejected, preventing SSRF bypass attacks.

    glance-download Import Method SSRF:

    The glance-download import method had redirect validation bypass vulnerabilities in two steps of the import flow:

    Image Data Download: When downloading image data from a remote Glance endpoint, redirects were not validated, allowing attackers to redirect to internal services.

    Metadata Fetch: When fetching image metadata from a remote Glance endpoint, redirects were not validated, allowing attackers to redirect to internal services.

    Both steps have been fixed by using SafeRedirectHandler to validate redirect destinations before following them.

    OVF Processing SSRF:

    The OVF processing functionality had a critical SSRF vulnerability with zero protection - no URI validation, no redirect validation, and no IP normalization. The code directly called urllib.request.urlopen(uri) without any validation checks. This has been fixed by adding URI validation using validate_import_uri() and redirect validation using SafeRedirectHandler.

    Affected Components:

    • glance.common.scripts.utils.get_image_data_iter()

    • glance.common.utils.validate_import_uri()

    • glance.async_.flows._internal_plugins.glance_download._DownloadGlanceImage.execute()

    • glance.async_.flows.api_image_import._ImportMetadata.execute()

    • glance.async_.flows.ovf_process._OVF_Process._get_ova_iter_objects()

    Impact:

    • Severity: High (web-download, glance-download), Critical (OVF processing)

    • Affected Versions: All versions prior to this fix

    • Workaround: Administrators can temporarily disable affected import methods by removing them from the enabled_import_methods configuration option

    Bugs #2138602, #2138672, #2138675

  • The new list_cached_nodes policy defaults to role:admin to avoid exposing backend worker endpoints to non-admin users.

Bug Fixes

  • Bug 2138602: Fixed SSRF vulnerability in web-download import method via HTTP redirect bypass and IP address encoding bypass. Added redirect validation using SafeRedirectHandler and IP address validation using Python’s ipaddress module to reject encoded IP formats and prevent bypass attacks.

    Bug 2138672: Fixed SSRF vulnerability in glance-download import method via HTTP redirect bypass. Added redirect validation for both image data download and metadata fetch operations.

    Bug 2138675: Fixed SSRF vulnerability in OVF processing functionality which lacked URI validation. Added URI validation and redirect validation to prevent SSRF attacks when processing OVA files.

  • Bug 2154257: Fixed a failure when proxying API requests to another Glance worker (for example during remote image deletion while hash calculation is in progress). get_ksa_client() referenced the removed [keystone_authtoken] identity_uri option; it now uses auth_url, with a fallback to www_authenticate_uri.