fixing CVE-2014-9684 bug 540678

Package-Manager: portage-2.2.14/cvs/Linux x86_64
Manifest-Sign-Key: 0x33ED3FD25AFC78BA

diff --git a/app-admin/glance/ChangeLog b/app-admin/glance/ChangeLog
index a75e5352ed945773b5670a12b06dbbade46b0e1b..d1691f06d057d394ff78f510a1456f5093f805b6 100644 (file)
--- a/app-admin/glance/ChangeLog
+++ b/app-admin/glance/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for app-admin/glance
 # Copyright 1999-2015 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-admin/glance/ChangeLog,v 1.59 2015/02/08 01:51:56 prometheanfire Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-admin/glance/ChangeLog,v 1.60 2015/03/09 01:28:07 prometheanfire Exp $
+
+*glance-2014.2.2-r1 (09 Mar 2015)
+
+  09 Mar 2015; Matthew Thode <prometheanfire@gentoo.org>
+  +files/2014.2.2-CVE-2015-1881.patch, +glance-2014.2.2-r1.ebuild,
+  -glance-2014.2.2.ebuild:
+  fixing CVE-2014-9684 bug 540678
 
 *glance-2014.2.2 (08 Feb 2015)
 

diff --git a/app-admin/glance/Manifest b/app-admin/glance/Manifest
index 593314bab24931791f8a1de998c7cd243c323355..d20d808f2d9643e9a6b45c8639c18e82b6bf5901 100644 (file)
--- a/app-admin/glance/Manifest
+++ b/app-admin/glance/Manifest
@@ -1,30 +1,31 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA256
 
+AUX 2014.2.2-CVE-2015-1881.patch 4298 SHA256 f0f2d7c1f3014781158f3f238226f1dc25cce61e23e689078a5378c6f726ee59 SHA512 6def2047c1e44b601338cdb9f84dc43e21d26a821214ee0b5f99bc820d21d6ebf235d34fac2a0e3628f3fd2bea7b12b5cd5c66065d290ecb10eb6e57d6269a8e WHIRLPOOL 2e874def7b33cd9254922df5e4501dec4d3d889f43b9b6cc93898767273661cc7d271b387df8203cbe495681e1f7a943ccd5752fb9964364d05fc166f4d5cd5b
 AUX glance-2013.2-sphinx_mapping.patch 582 SHA256 043c3f7ef413cf3675920880af57943b909ec9f3376f6e86a1ae1d5948d9ad98 SHA512 d012ce5eaed00c3ba7b6219813cee503f68cdb14b8e50eedc731afc63767e1867749d6e4824611e0d024b2fdebfe5a2b3ad53b0ad7b18a39defcc17094da4a0f WHIRLPOOL 659bf94e7740be3ea0d2f130b332e694ebdcca8b90acfb479b8502eec4b867eda999ec2c6cdecc1f3dcbe3e3ddf72798c76bdf16ab4ab561ce61975a451c4585
 AUX glance.confd 25 SHA256 5a53dcf1eece81a06a2dd0856b15f8abe20eb1072361b110f752e396e86a7843 SHA512 13e671d4544e58d7397c1a87eb1048ed4bb9561587fcd63783e377b2d25e810222ca3944e0c8cf13c524e64f94c435b456a0d6f7cacfb148e275377699a11ca9 WHIRLPOOL 862a310fbdd7b68f132c45797210011b607d9b5c8937d60c9f5933a4d625bc985ad0277fea26804681b7e0a674dc9da15fbef40502c4052d6742ef0a94e88f3d
 AUX glance.initd 651 SHA256 1b2fc0e11d572bfcc121cb995ea7b3cce63ee705a05d2fb34a9f99d655546553 SHA512 c0ed1cac2038dda8882d5ce013b948debf1e5e411a062d8c9cbfdb1e1683c94bfd78a3f3468de63e0cc28930c59c0ff323a3116ce6a74ccf5d8ad1d547805bad WHIRLPOOL b0b25f4e983bf9f46cb9dd5872d14b24dc90e3c383dc458c79d065e0855bbf838afc4a13f0c92db640cd64311e22985d0b92e1ca4d428ce8b1f08ff23b89cecf
 DIST glance-2014.2.1.tar.gz 780312 SHA256 8059435c485be487d7b1e73da2f758e9871abf74cddde9b592939f05eb77cb45 SHA512 53797d09672188092d667efed6a914d9ec5a2c014687c2ec61473ec27fb9426391213622e0166c37a969128290c4cb039f07398d5f9906504794f984cc94cf91 WHIRLPOOL 41d05b55d2ac2c9310f0d3583e782c40c5dfecd256bb51219947016f3e71874eb2321c98c3a1fe2fd807b0f312aca0dbaeff8196df4e7ad20ddde662b41be5c9
 DIST glance-2014.2.2.tar.gz 782152 SHA256 bf7273ff9e89e9a7edda76e7a2235989a25109fb728edc4afa956e74ef54a08c SHA512 c8ea798e8e265679c714a252337461414cfc11cafeaecfd8afb3e8483d1396a7b161ab05bd46959a6e831fa57f184dabad9af4140c91854151ffeba99c8d4225 WHIRLPOOL 3761db8233d487f9ca461b50f94438ea00a2c33540a2d26323f57280dcbf0fbb6187153ea0d14c604c1ea50f1252a4e715b8ee3e8cd0d7be7a8d40e9184ee3b9
 EBUILD glance-2014.2.1-r2.ebuild 6089 SHA256 2502dc282246dffa2cabe34ce1e8c6e3f3d45104e1af7308468129ea4a47834b SHA512 1a478828631099dc446dc1c53ec166ee317f9323f37e9caf20163fbfebf155a0cbc54ef22d52aae139ed656e48c44393e8243bf5189a44cbb40402f0d48d48b2 WHIRLPOOL 8c48eb81b8d8903b02d2d79bef9fc377cf1cf608a06174c4f34bf02f06666e21cd5e14a28029e8335e931a3c94a349978d0759b91d946c04725e22f1c3a7aabb
-EBUILD glance-2014.2.2.ebuild 5633 SHA256 411e80c1263829f7e5ab0ea08e3bcfc9e68b51b4b4555c366ffa410783795477 SHA512 013fb4e46c7d02d51f7f4b4b829f4c741c9419bf8c680558c9669e1a95e0fbcafc348beab02400e5042596951359d1cb57fbb20f43263ec77061f84f89badf7c WHIRLPOOL d9b089a2b1f4067152f7c36e1bbe781be15c0877d20e7a044193e7611c43d458c844a24cad606402ef550b4ecdc68881231ab8e122b92c3efd11290a8e001c6c
+EBUILD glance-2014.2.2-r1.ebuild 5680 SHA256 9eaa64c376ffdcef24d04ee0196b636faed229316b6f2b8dba788076e1e2ab83 SHA512 8a5082004058ebac728f4314a1b0dfbac278768f19a830a3db7460a43fb1cf248f921c6a76aab3c5c58eb27be74676341a89b1bc5d65826f4dc073b6012f3fbc WHIRLPOOL 3d7b27fd2bfc89cba9efcce459172344687be313a94d54840efc21b9d69bc7907852c88c37c5f8a7a14a37de5876254414226d3b23c4e712363115978b70d337
 EBUILD glance-2014.2.9999.ebuild 5643 SHA256 660c69ecf6aa38c5b73f96514bc65813ac6280bbed852c544cc630fd0d5b742a SHA512 0e7fa36b215579b17ec543c72da1c494526d4235cfbfae178e7d0995fcc2b28524016b72ab9080dd2f2da50813b40a886d6ef159c0f8457776f1a0ccb93c59d8 WHIRLPOOL 992e9a693e7b8b33460dc609232f674f8a7fd18d3da2fcfe1da2cc9484a3e855e2efe472295084c24572201e46e2cda2a7f594b6544abd9d4889ec8ab69737ad
-MISC ChangeLog 12086 SHA256 3877cebf88f33f84e8c2c35c66cba4e36ca7baf3e6164077701c7cc7ef987a54 SHA512 37227d5bdd25e0ceba1fca1c155d2a883609fb79284c55c2a634fee13dd67f8b7ccc1e255a0358cf4fa03f30f6aaee00d4fa2ac86dbb0fd6b428b22d35a578fd WHIRLPOOL e7f12b7f19f4590ed9980c56bbdb8463057c3b981859d262f3b94b0c24292f84c269ed836f6e145520ea464cb684208656dcc80b3b6bcf7968b4ea3ad605ccf3
+MISC ChangeLog 12307 SHA256 6255ab8fa689f7df9218f6f39f549be40323445c2ae44f4f758519c86cef35f3 SHA512 e86063f5fde28bea928fec657a5d90e6843e51a70dab0f2c637887f4d64908b58a5d87c41d1decc9bcc38ef644390d4ed1c496ac82ae6bbf5b5b013db959e5f6 WHIRLPOOL 8653c61782cc5669ae33632ee499ea067f3bbd29ead755f0d4cd2bc79a5e98ad2c04df2b258d6ac54dfdb56e006e7b0726afdb92d72f237d34e4d7742047bba3
 MISC metadata.xml 607 SHA256 b74d960c096528dbb7c9be6b0da777e10abe32928459f045e7c58b0156e22d95 SHA512 e38e4dd740fe55d73d6d97fd9ffa3aec5466fbb5f8e6484b125560313245ae697a0dcf612fb065125c6737a8254b6218c0703f7de79437bb2799c6c67f386e45 WHIRLPOOL 445bf712fd733fa90c395cc24fd02155bed15b092713d502b54331da9237f397877c2328adbf4049ee64ae163713ce031ebe5048c8826ed1a011d4ebcdbb681d
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
-iQIcBAEBCAAGBQJU1sFYAAoJEGSje+quGaToJZsQANOj7yryANQIkRFSF9KMB4PW
-N7qlxyjae0la3pPnNQifuKOsRXodg40nWnjlqQEd8KEMESGJjz9q+GZL52LscldZ
-eiNx6Fn3fmOcrz5FguhsMmqaLQzn7pCcoqVdGnID4e5XnV+i1G1janNefUARR8gA
-rsAELjOBQX+1EZnUrte0tBt9pScg9iHwMJ6cNhVAVqMJQoPVczXqvO6yZBkgg2pZ
-TX6yeFl7JHsZnWW2x7IrDWh2HQKe+89xYPff+9O3Lnh7zXYVOlytkEBOMb4yfq9W
-vvjw7n5AYr4cMwc2vTGjba5fgY7X08DNoiIYkfQ/86wsvv1SQfDnrgL48v5ltM9/
-98LRvE/3BXsOIxITKSTqV3Q2uG7IzQHBo5kSbCTbsDe/dTNhNseSw8PFtZLE5SGE
-O2/Ix1a4t6Xdzv6Z1vJdwegY9nHK/hCO4g6Vz6aoFpsR1BFBIYOlJ5llOKv912c4
-51bWEAioV9HfGY+Y/IjXlirKKFiOGJ47hIQIraqIw9gC3DK8b7rIsAvxq7wHjt/m
-X/zdg9Af//rY+ycCaI7rizOgxjrQT5356ZYXWaHVOet+gNS1C59JoARj4LVYdHn9
-bUYiPkqSpj58ZrYGjCdUc9xUX61D19Yzsn8NJd0YWEoU6nrGEQ48e8MGOvePHg+B
-Q4YNmWcdrnOP//E8PKdi
-=MM1Q
+iQIcBAEBCAAGBQJU/PdYAAoJEGSje+quGaTo9ecP/0xyCpnCypE8fYPx0ihzJIRh
+RYtozjydn/eOlZCB2ayuFRZvqJieElq3hcXh1UvfQvyDQUSzSM024LOZtRWukOOl
+EXdJFE/XREP3K7Ug5pUO6yxwQtVQCLLpwj+AvgoYEn7p2bE9xdcQxsvEq7mwtwvd
+SDN64DDAh7Qctu3JQiDLnqAxQxv7odzOcr0uv0kfOE/OY3ApJFsyouhJZScniq1y
+f3TwUOKWiEqK5H/jZVih+FhDYFGscdlPJ2mMhUnPhFEy8ogLZ6y9MMGmMIUN+uAF
+SIzPt94Mgx5Q+ahuj/8zGv5uy0nmaVrsgUHLgVxwlaXQurUb1CYVq/sWIjJ0LrWU
+/3Gnblzjc/pHgQv/Q3JfhkQDgfIJatjh2sm1kiSTKgq9qCQYU6+WbX9CfuwOZXKv
+O4JSK2IiVbElu3BIBgCq7NJuq47PiJ82GDCiUVs4ch4a8Dlyp+TJUbW3H38gJkQG
+rhn1tk6NgZdpzgmYQYi7y35/jzgt+GlKpqb1HCTc5lJQqRCZzA4x+LbSsEmDtmGY
+XTVMUBWnlgEMR+sFAY0DnR76go5IuZWvrZR9gnI7g04dYVaVJ9XXAM1DvsVtw0yS
+CR8uVw2HzEX1UU/hwEyHcIexCKdA0qWTIuvpf71em5pzB854jLOSzZqUe4W1v7u/
+XpTopAw25Ubjn7Cidd/I
+=plyS
 -----END PGP SIGNATURE-----

diff --git a/app-admin/glance/files/2014.2.2-CVE-2015-1881.patch b/app-admin/glance/files/2014.2.2-CVE-2015-1881.patch
new file mode 100644 (file)
index 0000000..f7c40b3
--- /dev/null
+++ b/app-admin/glance/files/2014.2.2-CVE-2015-1881.patch
@@ -0,0 +1,93 @@
+From 25a722e614eacc47e4658f0bca6343fa52f7d03f Mon Sep 17 00:00:00 2001
+From: abhishekkekane <abhishek.kekane@nttdata.com>
+Date: Thu, 12 Feb 2015 04:09:14 -0800
+Subject: [PATCH] Image data remains in backend for deleted image
+
+Trying to delete image created using task api (import-from) image gets
+deleted from the database, but image data remains in the backend. Import
+task does not update the location of the image and it remains None even
+image becomes active. Location entry is not added in the database in
+image_locations table.
+
+Added location information to the image before saving the image in
+the database.
+
+SecurityImpact
+
+Conflicts:
+       glance/common/scripts/image_import/main.py
+
+Change-Id: Ie389de6538a9b98dc51c7d781b81b3ab10b83842
+Closes-Bug: #1420696
+(cherry picked from commit 78b5b0a9575cd5e9c4543ec0e8fd6072af1f0ebb)
+---
+ glance/common/scripts/image_import/main.py         | 30 +++++++++++-----------
+ .../unit/common/scripts/image_import/test_main.py  |  3 ++-
+ 2 files changed, 17 insertions(+), 16 deletions(-)
+
+diff --git a/glance/common/scripts/image_import/main.py b/glance/common/scripts/image_import/main.py
+index 24dd52b..72c992e 100644
+--- a/glance/common/scripts/image_import/main.py
++++ b/glance/common/scripts/image_import/main.py
+@@ -84,29 +84,29 @@ def import_image(image_repo, image_factory, task_input, task_id, uri):
+     # NOTE: set image status to saving just before setting data
+     original_image.status = 'saving'
+     image_repo.save(original_image)
+-    set_image_data(original_image, uri, None)
+-
+-    # NOTE: Check if the Image is not deleted after setting the data
+-    # before setting it's status to active. We need to set the status
+-    # explicitly here using the Image object returned from image_repo .The
+-    # Image object returned from create_image method does not have appropriate
+-    # factories wrapped around it.
+     image_id = original_image.image_id
++
++    # NOTE: Retrieving image from the database because the Image object
++    # returned from create_image method does not have appropriate factories
++    # wrapped around it.
+     new_image = image_repo.get(image_id)
+-    if new_image.status in ['saving']:
+-        new_image.status = 'active'
+-        new_image.size = original_image.size
+-        new_image.virtual_size = original_image.virtual_size
+-        new_image.checksum = original_image.checksum
++    set_image_data(new_image, uri, None)
++
++    # NOTE: Check if the Image is not deleted after setting the data
++    # before saving the active image. Here if image status is
++    # saving, then new_image is saved as it contains updated location,
++    # size, virtual_size and checksum information and the status of
++    # new_image is already set to active in set_image_data() call.
++    image = image_repo.get(image_id)
++    if image.status == 'saving':
++        image_repo.save(new_image)
++        return image_id
+     else:
+         msg = _LE("The Image %(image_id)s object being created by this task "
+                   "%(task_id)s, is no longer in valid status for further "
+                   "processing." % {"image_id": new_image.image_id,
+                                    "task_id": task_id})
+         raise exception.Conflict(msg)
+-    image_repo.save(new_image)
+-
+-    return image_id
+ 
+ 
+ def create_image(image_repo, image_factory, image_properties, task_id):
+diff --git a/glance/tests/unit/common/scripts/image_import/test_main.py b/glance/tests/unit/common/scripts/image_import/test_main.py
+index 27f502b..a81a66c 100644
+--- a/glance/tests/unit/common/scripts/image_import/test_main.py
++++ b/glance/tests/unit/common/scripts/image_import/test_main.py
+@@ -56,7 +56,8 @@ class TestImageImport(test_utils.BaseTestCase):
+                     image_id,
+                     image_import_script.import_image(image_repo, image_factory,
+                                                      task_input, None, uri))
+-                self.assertEqual('active', image.status)
++                # Check image is in saving state before image_repo.save called
++                self.assertEqual('saving', image.status)
+                 self.assertTrue(image_repo.save.called)
+                 mock_set_img_data.assert_called_once_with(image, uri, None)
+                 self.assertTrue(image_repo.get.called)
+-- 
+2.0.5
+

diff --git a/app-admin/glance/glance-2014.2.2.ebuild b/app-admin/glance/glance-2014.2.2-r1.ebuild
similarity index 98%
rename from app-admin/glance/glance-2014.2.2.ebuild
rename to app-admin/glance/glance-2014.2.2-r1.ebuild
index 28140ce6e116a9b16959ffe86484874c42a7c8fc..5a5d7877b6e19ad3a874d676b8f9c23dccefaee7 100644 (file)
--- a/app-admin/glance/glance-2014.2.2.ebuild
+++ b/app-admin/glance/glance-2014.2.2-r1.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2015 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-admin/glance/glance-2014.2.2.ebuild,v 1.1 2015/02/08 01:51:56 prometheanfire Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-admin/glance/glance-2014.2.2-r1.ebuild,v 1.1 2015/03/09 01:28:07 prometheanfire Exp $
 
 EAPI=5
 PYTHON_COMPAT=( python2_7 )
@@ -112,6 +112,7 @@ RDEPEND="
 
 PATCHES=(
        "${FILESDIR}/${PN}-2013.2-sphinx_mapping.patch"
+       "${FILESDIR}/2014.2.2-CVE-2015-1881.patch"
 )
 
 pkg_setup() {