Debian Patches

Status for glance/2:32.0.0-4

Patch Description Author Forwarded Bugs Origin Last update
sql_conn-registry.patch Fixes default connection in glance-registry.conf & glance-api.conf
===================================================================		 Thomas Goirand <zigo@debian.org> no 2014-04-15
missing-files.patch package missing files Thomas Goirand <zigo@debian.org> not-needed 2026-03-14
No_DNS_resolution_in_test.patch No DNS resolution in test This avoids DNS resolution during unit tests:
test_utils.ImportURITestCase.test_ignored_filtering_options
and
test_utils.ImportURITestCase.test_validate_import_uri
.
which are failing in downstream distributions that do not have
Internet access when running tests.

===================================================================		 Thomas Goirand <zigo@debian.org> yes 2026-03-20
OSSN-0105_Apply_import_URI_filtering_to_legacy_import_tasks.patch Apply import URI filtering to legacy import tasks Legacy type=import tasks only ran validate_location_uri, so
import_from could skip the same host/port/path checks used for
modern image import. Route import_from through a small helper that
reuses validate_location_uri then validate_import_uri, and
reject bad URIs early when creating import tasks.

diff --git a/glance/api/v2/tasks.py b/glance/api/v2/tasks.py
index f7be4a0..d73090c 100644		 Abhishek Kekane <akekane@redhat.com> yes debian upstream upstream, https://review.opendev.org/c/openstack/glance/+/994466 2026-08-12
CVE-2026-71196-71197-71198_1_Properly_limit_web-download_image_fetch_size.patch Properly limit web-download image fetch size If web-download is pointed at a source that does not provide a
Content-Length header, we will read until the end of stream. This
could fill our disk if the source is unlimited (or insanely large).
This change makes us honor the existing image_size_cap restriction
we enforce elsewhere to avoid this unbounded behavior.

diff --git a/glance/common/scripts/utils.py b/glance/common/scripts/utils.py
index 81f24fd14..73046954c 100644		 Dan Smith <dansmith@redhat.com> yes debian upstream upstream, pre-OSSA mailing list 2026-08-28
CVE-2026-71196-71197-71198_2_Block_restricted_addresses_in_web-download_import_URIs.patch Block restricted addresses in web-download import URIs Reject import URIs targeting loopback, link-local, private, reserved,
multicast, or unspecified addresses unless the host is listed in
allowed_hosts. Also reject hostnames that resolve to those addresses.
.

===================================================================		 Abhishek Kekane <akekane@redhat.com> yes debian upstream upstream, pre-OSSA mailing list 2026-08-28
CVE-2026-71196-71197-71198_3_Pin_import_downloads_to_validated_destination_addresses.patch Pin import downloads to validated destination addresses Re-validate import URIs at fetch time, resolve DNS when the download
starts, and pin HTTP connections to the validated destination address.
This closes the DNS rebinding window between API validation and async
worker download.
.

===================================================================		 Abhishek Kekane <akekane@redhat.com> yes debian upstream upstream, pre-OSSA mailing list 2026-07-23
CVE-2026-71196-71197-71198_4_Block_restricted_hosts_when_adding_HTTP_image_locations.patch Block restricted hosts when adding HTTP image locations Apply import_filtering_opts to HTTP(S) locations and validate
the URI before contacting the backend, so location add cannot
SSRF glance-api into loopback or link-local targets.
.

===================================================================		 Abhishek Kekane <akekane@redhat.com> yes debian upstream upstream, pre-OSSA mailing-list 2026-08-28

All known versions for source package 'glance'

Links