CVE-2013-0212: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Published: 2013-02-24T21:55Z
Repository: https://github.com/openstack/glance
Language: Python
Files changed: glance/store/swift.py
Commit date: 2013-01-29 09:54:56 -0500
Commit message: Remove Swift location/password from messages.

Updates several exceptions and log messages in the Swift backend
so that they don't include Swift location URI's which may contain
passwords when used in Swift single tenant mode.

Fixes LP Bug #1098962.

Change-Id: I458de58563343347d5c976fe1ad084cc7e3280eb

Diff: diff --git a/glance/store/swift.py b/glance/store/swift.py
index 2899fce1..dfe3696e 100644
--- a/glance/store/swift.py
+++ b/glance/store/swift.py
@@ -134,11 +134,11 @@ class StoreLocation(glance.store.location.StoreLocation):
                        "of a scheme. If you have specified a URI like "
                        "swift://user:pass@http://authurl.com/v1/container/obj"
                        ", you need to change it to use the "
                        "swift+http:// scheme, like so: "
                        "swift+http://user:pass@authurl.com/v1/container/obj")
-            LOG.debug(_("Invalid store uri %(uri)s: %(reason)s") % locals())
+            LOG.debug(_("Invalid store URI: %(reason)s") % locals())
             raise exception.BadStoreUri(message=reason)
 
         pieces = urlparse.urlparse(uri)
         assert pieces.scheme in ('swift', 'swift+http', 'swift+https')
         self.scheme = pieces.scheme
@@ -160,12 +160,11 @@ class StoreLocation(glance.store.location.StoreLocation):
             netloc = path[0:path.find('/')].strip('/')
             path = path[path.find('/'):].strip('/')
         if creds:
             cred_parts = creds.split(':')
             if len(cred_parts) != 2:
-                reason = (_("Badly formed credentials '%(creds)s' in Swift "
-                            "URI") % locals())
+                reason = (_("Badly formed credentials in Swift URI."))
                 LOG.debug(reason)
                 raise exception.BadStoreUri()
             user, key = cred_parts
             self.user = urllib.unquote(user)
             self.key = urllib.unquote(key)
@@ -179,11 +178,11 @@ class StoreLocation(glance.store.location.StoreLocation):
             if not netloc.startswith('http'):
                 # push hostname back into the remaining to build full authurl
                 path_parts.insert(0, netloc)
                 self.auth_or_store_url = '/'.join(path_parts)
         except IndexError:
-            reason = _("Badly formed Swift URI: %s") % uri
+            reason = _("Badly formed Swift URI.")
             LOG.debug(reason)
             raise exception.BadStoreUri()
 
     @property
     def swift_url(self):
@@ -239,12 +238,12 @@ class BaseStore(glance.store.base.Store):
                     container=location.container, obj=location.obj,
                     resp_chunk_size=self.CHUNKSIZE)
         except swiftclient.ClientException, e:
             if e.http_status == httplib.NOT_FOUND:
                 uri = location.get_uri()
-                raise exception.NotFound(_("Swift could not find image at "
-                                           "uri %(uri)s") % locals())
+                msg = _("Swift could not find image at URI.")
+                raise exception.NotFound(msg)
             else:
                 raise
 
         class ResponseIndexable(glance.store.Indexable):
             def another(self):
@@ -373,12 +372,11 @@ class BaseStore(glance.store.base.Store):
 
             return (location.get_uri(), image_size, obj_etag)
         except swiftclient.ClientException, e:
             if e.http_status == httplib.CONFLICT:
                 raise exception.Duplicate(_("Swift already has an image at "
-                                            "location %s") %
-                                          location.get_uri())
+                                            "this location"))
             msg = (_("Failed to add object to Swift.\n"
                      "Got error from Swift: %(e)s") % locals())
             LOG.error(msg)
             raise glance.store.BackendException(msg)
 
@@ -417,12 +415,12 @@ class BaseStore(glance.store.base.Store):
                 connection.delete_object(location.container, location.obj)
 
         except swiftclient.ClientException, e:
             if e.http_status == httplib.NOT_FOUND:
                 uri = location.get_uri()
-                raise exception.NotFound(_("Swift could not find image at "
-                                           "uri %(uri)s") % locals())
+                msg = _("Swift could not find image at URI.")
+                raise exception.NotFound(msg)
             else:
                 raise
 
     def _create_container_if_missing(self, container, connection):
         """
@@ -576,12 +574,12 @@ class MultiTenantStore(BaseStore):
         try:
             connection.post_container(location.container, headers=headers)
         except swiftclient.ClientException, e:
             if e.http_status == httplib.NOT_FOUND:
                 uri = location.get_uri()
-                raise exception.NotFound(_("Swift could not find image at "
-                                           "uri %(uri)s") % locals())
+                msg = _("Swift could not find image at URI.")
+                raise exception.NotFound(msg)
             else:
                 raise
 
     def create_location(self, image_id):
         specs = {'scheme': self.scheme,

Vulnerable code:             LOG.debug(_("Invalid store uri %(uri)s: %(reason)s") % locals())
                reason = (_("Badly formed credentials '%(creds)s' in Swift "
                            "URI") % locals())
            reason = _("Badly formed Swift URI: %s") % uri
                raise exception.NotFound(_("Swift could not find image at "
                                           "uri %(uri)s") % locals())
                                            "location %s") %
                                          location.get_uri())
                raise exception.NotFound(_("Swift could not find image at "
                                           "uri %(uri)s") % locals())
                raise exception.NotFound(_("Swift could not find image at "
                                           "uri %(uri)s") % locals())
Fixed code:             LOG.debug(_("Invalid store URI: %(reason)s") % locals())
                reason = (_("Badly formed credentials in Swift URI."))
            reason = _("Badly formed Swift URI.")
                msg = _("Swift could not find image at URI.")
                raise exception.NotFound(msg)
                                            "this location"))
                msg = _("Swift could not find image at URI.")
                raise exception.NotFound(msg)
                msg = _("Swift could not find image at URI.")
                raise exception.NotFound(msg)