2025.2 Series Release Notes

31.1.0-13

Security Issues

• Fixed insufficient validation of import_from URIs for legacy type=import tasks created through the deprecated Task API (POST /v2/tasks). Those requests were not held to the same URI rules as modern image import, so Server-Side Request Forgery (SSRF) protections could be weaker on that path.

  Impact:

  • Severity: High (SSRF-style exposure through attacker-controlled import_from URIs on the legacy import task path)

  • Affected versions: All versions prior to this fix that still expose the Task API for type=import tasks

  Mitigation without upgrading (especially for unmaintained releases):

  The Task API has been deprecated for a long time; the simplest mitigation is to block it in your deployment, for example set tasks_api_access to a check that never matches (such as ! in a policy YAML file) so /v2/tasks is denied for all callers.

• Fixed a Server-Side Request Forgery (SSRF) vulnerability in the web-download image import method. With the default import_filtering_opts configuration, authenticated users could supply URIs targeting loopback or link-local addresses (for example cloud metadata at 169.254.169.254) and read the response through the imported image data.

  Glance now rejects import URIs that target loopback or link-local IP addresses unless the host is explicitly listed in allowed_hosts. Hostnames that resolve to any of those address types are also rejected. Private RFC1918 addresses are not blocked by this check so private clouds can continue to import from internal hosts.

• Fixed a Server-Side Request Forgery (SSRF) vulnerability when adding HTTP(S) image locations. Authenticated users could supply location URLs targeting loopback or link-local addresses (for example cloud metadata at 169.254.169.254). Glance would fetch those URLs from glance-api during location validation and hashing.

  HTTP(S) locations are now checked with the same import_filtering_opts host filtering used for web-download. Glance validates the URI before contacting the backend so restricted destinations never trigger an outbound request from the location-add path.

  This applies to POST /v2/images/{id}/locations and the legacy PATCH locations API when HTTP store is enabled.

• A bug in the web-download import plugin was fixed which would allow a remote URI to omit the Content-Length header and feed glance data forever until the staging disk filled. We now honor the image_size_cap limit for these streams. Note that the default value for this limit is 1TiB, which may be higher than is reasonable for some deployments. Operators should take this opportunity to review that setting for correctness.

Bug Fixes

• Bug 2152110: Align legacy type=import task URI checks with modern image import so import_from cannot bypass the same restrictions.

• Bug 2158998: Block loopback and link-local destination addresses during web-download URI validation to prevent SSRF against local services and cloud metadata endpoints.

• Bug 2161330: Block restricted destination addresses when adding HTTP(S) image locations to prevent SSRF against local services and cloud metadata endpoints.

• Fix a regression introduced when fixing CVE-2026-71197. Now during image import via web-download, if the image host is resolved to several IP addresses by DNS, all of them that pass filtering critera will be tried one by one.

  This among others ensures that if DNS resolves to both IPv4 and IPv6 addresses but Glance itself is running in a single stack network, the correct IP address that Glance can connect to will eventually be tried.

31.1.0

Security Issues

• Fixed multiple Server-Side Request Forgery (SSRF) vulnerabilities in Glance’s image import functionality. These vulnerabilities could allow attackers to bypass URL validation and access internal resources.

  web-download Import Method SSRF:

  The web-download import method had two SSRF vulnerabilities:

  HTTP Redirect Bypass: The web-download import method did not validate redirect destinations when following HTTP redirects. An attacker could provide an initial URL that passed validation, but redirect to an internal or disallowed resource that would bypass the security checks. This has been fixed by implementing SafeRedirectHandler that validates redirect destinations before following them using the same validate_import_uri() checks as the initial URL.

  IP Address Encoding Bypass: The web-download import method’s URL validation could be bypassed by encoding IP addresses in alternative formats (decimal integer, hexadecimal, octal). For example, 127.0.0.1 could be encoded as 2130706433 (decimal) or 0x7f000001 (hexadecimal) to bypass blacklist checks. This has been fixed by implementing normalize_hostname() function that uses Python’s ipaddress module to validate IP addresses. The ipaddress module only accepts standard dotted-decimal notation for IPv4 and standard format for IPv6, automatically rejecting all encoded formats (decimal, hexadecimal, octal). Any attempt to use encoded IP formats is rejected, preventing SSRF bypass attacks.

  glance-download Import Method SSRF:

  The glance-download import method had redirect validation bypass vulnerabilities in two steps of the import flow:

  Image Data Download: When downloading image data from a remote Glance endpoint, redirects were not validated, allowing attackers to redirect to internal services.

  Metadata Fetch: When fetching image metadata from a remote Glance endpoint, redirects were not validated, allowing attackers to redirect to internal services.

  Both steps have been fixed by using SafeRedirectHandler to validate redirect destinations before following them.

  OVF Processing SSRF:

  The OVF processing functionality had a critical SSRF vulnerability with zero protection - no URI validation, no redirect validation, and no IP normalization. The code directly called urllib.request.urlopen(uri) without any validation checks. This has been fixed by adding URI validation using validate_import_uri() and redirect validation using SafeRedirectHandler.

  Affected Components:

  • glance.common.scripts.utils.get_image_data_iter()

  • glance.common.utils.validate_import_uri()

  • glance.async_.flows._internal_plugins.glance_download._DownloadGlanceImage.execute()

  • glance.async_.flows.api_image_import._ImportMetadata.execute()

  • glance.async_.flows.ovf_process._OVF_Process._get_ova_iter_objects()

  Impact:

  • Severity: High (web-download, glance-download), Critical (OVF processing)

  • Affected Versions: All versions prior to this fix

  • Workaround: Administrators can temporarily disable affected import methods by removing them from the enabled_import_methods configuration option

  Bugs #2138602, #2138672, #2138675

Bug Fixes

• Bug 2127798: Automatic S3 credential update when EC2 credentials are rotated

  Glance now automatically updates S3 image location URLs when EC2 credentials are rotated in Keystone. Previously, images with S3 locations would become inaccessible after credential rotation, requiring manual intervention to update location metadata. This fix ensures seamless credential rotation without breaking image access.

• Bug 2138602: Fixed SSRF vulnerability in web-download import method via HTTP redirect bypass and IP address encoding bypass. Added redirect validation using SafeRedirectHandler and IP address validation using Python’s ipaddress module to reject encoded IP formats and prevent bypass attacks.

  Bug 2138672: Fixed SSRF vulnerability in glance-download import method via HTTP redirect bypass. Added redirect validation for both image data download and metadata fetch operations.

  Bug 2138675: Fixed SSRF vulnerability in OVF processing functionality which lacked URI validation. Added URI validation and redirect validation to prevent SSRF attacks when processing OVA files.

31.0.0

New Features

• Added support for the optional x-openstack-image-size header in image upload endpoints. This header allows clients to specify the expected size of image data in bytes when uploading images via the PUT /v2/images/{image_id}/file and PUT /v2/images/{image_id}/stage endpoints.

  When the header is present, the server validates that the uploaded data size matches the specified value. If the actual size does not match the expected size, a 400 (Bad Request) response is returned. When the header is not present, the server calculates the image size based on the actual request body size.

  This feature improves data integrity validation during image uploads and helps prevent incomplete or corrupted uploads.

Upgrade Notes

• The following metadata definitions have been modified in the Flamingo release:

  • Added hw_memory_encryption_model enumerations in the OS::Compute::Libvirt namespace.

  You may upgrade these definitions using:

  glance-manage db load_metadefs [--path <path>] [--merge] [--prefer_new]

• Support for Pyton 3.9 has been removed. Now Python 3.10 is the minimum version supported.