#1144212 [OSSN-0105] OpenStack Glance legacy Tasks import bypasses image import URI filtering #1144212
- Package:
- src:glance
- Source:
- src:glance
- Submitter:
- Thomas Goirand
- Date:
- 2026-08-21 03:47:01 UTC
- Severity:
- normal
- Tags:
As per upstream announce at: https://wiki.openstack.org/wiki/OSSN/OSSN-0105 Glance legacy Tasks import bypasses image import URI filtering Summary The deprecated Glance /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (SSRF). The tasks API has been admin-only since Xena and deprecated for several releases. Affected Services / Software: glance: >=30.0.0 <30.3.0, >=31.0.0 <31.1.1, ==32.0.0 Discussion: The legacy tasks import path uses a permissive URI validator that only checks for http:// or https:// prefixes, bypassing the host and port restrictions enforced by the modern web-download import. Recommended Actions: Disable the legacy tasks API via policy if you are not using it. Otherwise, upgrade Glance to a version containing the fix. Patches: The following reviews contain the fix for this issue: 2026.2/hibiscus (development): https://review.opendev.org/c/openstack/glance/+/993588 2026.1/gazpacho: https://review.opendev.org/c/openstack/glance/+/994466 2025.2/flamingo: https://review.opendev.org/c/openstack/glance/+/994592 2025.1/epoxy: https://review.opendev.org/c/openstack/glance/+/1000061 Credits: Tim Shephard, roiai.ca Contacts / References Authors: Goutham Pacha Ravi, Red Hat This OSSN: https://wiki.openstack.org/wiki/OSSN/OSSN-0105 Original Launchpad bug: https://bugs.launchpad.net/glance/+bug/2152110 Mailing List : [security-sig] tag on openstack-discuss@lists.openstack.org OpenStack Security : https://security.openstack.org/ CVE: none
Hello, Bug #1144212 in glance reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/glance/-/commit/3ee98944a07f171fa69405cd15adf1ae5de6ee32 ------------------------------------------------------------------------ * OSSN-0105: legacy Tasks import bypasses image import URI filtering. Applied upstream patch: "Apply import URI filtering to legacy import tasks" (Closes: #1144212). ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1144212
Hello, Bug #1144212 in glance reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/glance/-/commit/666649573d14fb77e08988ba5409c4017db9ec9a ------------------------------------------------------------------------ * OSSN-0105: legacy Tasks import bypasses image import URI filtering. Applied upstream patch: "Apply import URI filtering to legacy import tasks" (Closes: #1144212). ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1144212
Hello, Bug #1144212 in glance reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/glance/-/commit/fb4fd5fad16cd3cac6e15bfd0c3453f3f931f562 ------------------------------------------------------------------------ * OSSN-0105: legacy Tasks import bypasses image import URI filtering. Applied upstream patch: "Apply import URI filtering to legacy import tasks" (Closes: #1144212). ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1144212
Hello, Bug #1144212 in glance reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/glance/-/commit/7e745f0b1e18a3fbef31ffbffd78311a242e57b8 ------------------------------------------------------------------------ * OSSN-0105: legacy Tasks import bypasses image import URI filtering. Applied upstream patch: "Apply import URI filtering to legacy import tasks" (Closes: #1144212). ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1144212
Hello, Bug #1144212 in glance reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/glance/-/commit/cc913e0bc573ee941ed989859b24c752f79519d4 ------------------------------------------------------------------------ * OSSN-0105: legacy Tasks import bypasses image import URI filtering. Applied upstream patch: "Apply import URI filtering to legacy import tasks" (Closes: #1144212). ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1144212
Hello, Bug #1144212 in glance reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/glance/-/commit/7b64dd753e2658ef1e1bdd27d6401fa06abd0255 ------------------------------------------------------------------------ * OSSN-0105: legacy Tasks import bypasses image import URI filtering. Applied upstream patch: "Apply import URI filtering to legacy import tasks" (Closes: #1144212). ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1144212
Hello, Bug #1144212 in glance reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/glance/-/commit/ce6b2c0df7e6071c224b6d9c8f334a317f351ef3 ------------------------------------------------------------------------ * OSSN-0105: legacy Tasks import bypasses image import URI filtering. Applied upstream patch: "Apply import URI filtering to legacy import tasks" (Closes: #1144212). ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1144212
Hello, Bug #1144212 in glance reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/glance/-/commit/5526a4bff44152f7616fcdb9d4e1966cefd40a41 ------------------------------------------------------------------------ * OSSN-0105: legacy Tasks import bypasses image import URI filtering. Applied upstream patch: "Apply import URI filtering to legacy import tasks" (Closes: #1144212). ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1144212
We believe that the bug you reported is fixed in the latest version of
glance, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1144212@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated glance package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 12 Aug 2026 13:43:14 +0200
Source: glance
Architecture: source
Version: 2:32.0.0-3
Distribution: unstable
Urgency: high
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1144212
Changes:
glance (2:32.0.0-3) unstable; urgency=high
.
* OSSN-0105: legacy Tasks import bypasses image import URI filtering.
Applied upstream patch: "Apply import URI filtering to legacy import
tasks" (Closes: #1144212).
Checksums-Sha1:
4757507c6efbe6ca6a12c7ea9d16f87b023905c8 3707 glance_32.0.0-3.dsc
7ce869008f72c8397a34a5eaad3ea7ba165fe21f 23548 glance_32.0.0-3.debian.tar.xz
2a07eddc55303a81e550a03b2bb18151ccf140ff 18713 glance_32.0.0-3_amd64.buildinfo
Checksums-Sha256:
1ee42e9c0b6e5ab3410b12a7bd83f4d83488ee31e7483c00e54d3a3e3199be85 3707 glance_32.0.0-3.dsc
84863085443598274b5ebe0b4ee6a1033a31f685563bcb472d97e82a91930131 23548 glance_32.0.0-3.debian.tar.xz
044f6b1e2523ff3bb5b26a726bde2b1975cf34d831e3b1707d81c421519fae1d 18713 glance_32.0.0-3_amd64.buildinfo
Files:
002e109bdbc4564d50641c5dcb7d7a8b 3707 net optional glance_32.0.0-3.dsc
de15c698317af23ff59bb4603cdfc186 23548 net optional glance_32.0.0-3.debian.tar.xz
bf395a3acc7143bb2681cba973ad5132 18713 net optional glance_32.0.0-3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmp8YDkACgkQ1BatFaxr
Q/49/w//alNRGYjWdATm6mYiXhOxGeUY0tg3hKu1eVS/iXNzg1UxGCT2z5XBIMPb
tnxr62+y+k+XD95TDgqn4JOpgWGxhDTGJhgnW930WOk+Gd33cNC8Qyffi+3JHpLb
WGT61iDXZN1KOcqQY1nz0LNXQOjhB1OS5fyBgDZOs3lTgHeebtqSUe1QIvOtyBQL
5RCeiUDZMsHqlinoTjLU14QB/ZA8+qRYS4x2faY/yTbuymi7kKLTc3jFRODj8VFe
828P/3EEVKJS5CvmhF/RyMBkyYwaOEqX97MyA35IhwhhePtGqznBBpqSkxcYIXzY
fuO09zgB6x52liXCT5P4hxlotdOQ5VKEaTzYkdudcf1b3XUIge8rCoAuH8WucyJZ
gdid2qE2d8ArU6NG+vxXcFDR0a97EGiAQOttPq5s1/gCi9/ygx3fftzyUE75kkq5
C/b66GKEIfqaoTl/kRjgGkyWojUWBQO+09x8bJNcswgHaWa+2L4XWfKz46NgqpNO
0a3qXGBKCGkBnYVtiK1MeA6h3zPQfoFEFewxJwYUIkGkL0Eq5G+FJnl5xamhKa0G
433LfJX/IFyS7GL/cS6c5UsTy+WKndXuyR6Ik2GlvGWSkWa7eP9u9tt0lyvaDUxp
X6HKWb4eRUPlH4QIP8v2O1nhTfKK6z5iwDMzuygnDS53QkvlED8=
=xKct
-----END PGP SIGNATURE-----