Bug 956038 (CVE-2015-8234) - VUL-1: CVE-2015-8234: openstack-glance: Use of MD5 in OpenStack Glance image signature
Summary: VUL-1: CVE-2015-8234: openstack-glance: Use of MD5 in OpenStack Glance image ...
Status: RESOLVED UPSTREAM
Alias: CVE-2015-8234
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Minor
Target Milestone: ---
Assignee: Cloud Bugs
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/158920/
Whiteboard: CVSSv2:RedHat:CVE-2015-8234:2.4:(AV:L...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-11-20 14:00 UTC by Johannes Segitz
Modified: 2016-09-01 14:21 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2015-11-20 14:00:40 UTC 
CVE-2015-8234

Title: Use of MD5 in OpenStack Glance image signature
Reporter: Daniel P. Berrange (Red Hat)
Products: Glance
Affects: =11.0.0

Description:
Daniel P. Berrange from Red Hat reported a vulnerability in Glance image
signature. Glance computes cryptographic signature using MD5 hash of the
image. By crafting a malicious image that produces a MD5 collision, a
Glance backend operator may subvert the signature verification process,
resulting in a corrupted image. All Glance setups are affected.

References:
https://launchpad.net/bugs/1516031
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8234
http://seclists.org/oss-sec/2015/q4/323
http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8234.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8234
Comment 1 Swamp Workflow Management 2015-11-20 23:00:43 UTC 
bugbot adjusting priority
Comment 2 Vincent Untz 2016-01-04 16:40:49 UTC 
This seems to only impact Liberty (ie, Cloud 6). However, there's no upstream fix planned for this in Liberty, only in the next version.

Also, it really matters only if there's a malicious glance backend operator. I'm not really sure how this could happen in the context of our product.
Comment 3 Marcus Meissner 2016-06-01 12:02:32 UTC 
let us wait for upstream fix then.