From f0997c53d843315f8ee1b971644c01b93b07a44c Mon Sep 17 00:00:00 2001 From: Thierry Carrez Date: Thu, 1 Dec 2011 17:54:16 +0100 Subject: [PATCH] Sanitize EC2 manifests and image tarballs Prevent potential directory traversal with malicious EC2 image tarballs, by making sure the tarfile is safe before unpacking it. Fixes bug 894755 Prevent potential directory traversal with malicious file names in EC2 image manifests. Fixes bug 885167 Change-Id: If6109047307bd6e654ee9d1254f0d7f31cf741c1 --- MANIFEST.in | 1 + 1 file changed, 1 insertion(+) diff --git a/MANIFEST.in b/MANIFEST.in index b10dafc7b..2a947f823 100644 --- a/MANIFEST.in +++ b/MANIFEST.in @@ -37,6 +37,7 @@ include nova/tests/bundle/1mb.part.0 include nova/tests/bundle/1mb.part.1 include nova/tests/api/ec2/public_key/* include nova/tests/db/nova.austin.sqlite +include nova/tests/image/*.tar.gz include plugins/xenapi/README include plugins/xenapi/etc/xapi.d/plugins/objectstore include plugins/xenapi/etc/xapi.d/plugins/pluginlib_nova.py