UbuntuUpdates.org

Package "python3-glance-store"

Name: python3-glance-store

Description:

OpenStack Image Service store library - Python 3.x
Latest version: 2.0.0-0ubuntu4.3
Release: focal (20.04)
Level: security
Repository: main
Head package: python-glance-store
Homepage: https://github.com/openstack/glance_store

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "python3-glance-store"

All arch deb package
APT INSTALL

Other versions of "python3-glance-store" in Focal

Repository Area Version
base main 2.0.0-0ubuntu1
updates main 2.0.0-0ubuntu4.3

Changelog

Version: 2.0.0-0ubuntu4.3 2024-02-12 14:06:52 UTC

  python-glance-store (2.0.0-0ubuntu4.3) focal-security; urgency=medium

  * SECURITY UPDATE: access_key logged in DEBUG log level
    - debian/patches/CVE-2024-1141-1.patch: do not show access_key in
      glance_store/_drivers/s3.py.
    - debian/patches/CVE-2024-1141-2.patch: fix more access_key logging in
      glance_store/_drivers/s3.py.
    - CVE-2024-1141

 -- Marc Deslauriers <email address hidden> Thu, 08 Feb 2024 13:51:06 -0500
Source diff to previous version
CVE-2024-1141 A vulnerability was found in python-glance-store. The issue occurs when the package logs the access_key for the glance-store when the DEBUG log level

Version: 2.0.0-0ubuntu4.2 2023-05-23 14:07:21 UTC

  python-glance-store (2.0.0-0ubuntu4.2) focal-security; urgency=medium

  * SECURITY REGRESSION: Regressions in other projects (LP: #2020111)
    - debian/patches/series: Do not apply CVE-2023-2088.patch until
      patches are ready for all upstream OpenStack projects.
    - CVE-2023-2088

 -- Corey Bryant <email address hidden> Thu, 18 May 2023 11:12:41 -0400
Source diff to previous version
CVE-2023-2088 OSSA-2023-003: Unauthorized volume access through deleted volume attachments

Version: 2.0.0-0ubuntu4.1 2023-05-11 19:07:14 UTC

  python-glance-store (2.0.0-0ubuntu4.1) focal-security; urgency=medium

  * SECURITY UPDATE: Unauthorized File Access
    - debian/patches/CVE-2023-2088.patch: Add force to os-brick
      disconnect.
    - CVE-2023-2088

 -- Corey Bryant <email address hidden> Tue, 09 May 2023 09:32:09 -0400
CVE-2023-2088 OSSA-2023-003: Unauthorized volume access through deleted volume attachments


About   -   Send Feedback to @ubuntu_updates