Debian Patches
Status for python-glance-store/5.7.0-5
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| CVE-2026-51773_refuse-vim-cookie-to-untrusted-hosts.patch | Refuse to send VMware VIM session cookie to untrusted hosts StoreLocation.parse_uri() accepted any vsphere:// server_host, and _retry_request() unconditionally attached the VIM session cookie (vmware_soap_session) to requests sent to loc.https_url. With show_multiple_locations enabled in Glance, an authenticated project user could add an image location pointing to an attacker controlled host, and any validation or read of that location would leak the Glance service account's vCenter/ESXi credentials (CVE-2026-51773). . _retry_request() now validates the target host against the configured vmware_server_host before building the cookie or sending anything, and raises BadStoreUri on mismatch. This also covers redirect targets: cross-host redirects were previously only "working" by leaking the cookie, so they cannot legitimately be preserved. |
Thomas Goirand <zigo@debian.org> | yes | debian upstream | 2026-10-09 |