Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1xNzNmLXZqYzItM2dxZs4AAdFH

OpenStack Image Service (Glance) allows remote authenticated users to read arbitrary file

The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.

Permalink: https://github.com/advisories/GHSA-q73f-vjc2-3gqf
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xNzNmLXZqYzItM2dxZs4AAdFH
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: over 1 year ago

Identifiers: GHSA-q73f-vjc2-3gqf, CVE-2015-5163
References:

• https://nvd.nist.gov/vuln/detail/CVE-2015-5163
• https://bugs.launchpad.net/glance/+bug/1471912
• http://lists.openstack.org/pipermail/openstack-announce/2015-August/000527.html
• http://rhn.redhat.com/errata/RHSA-2015-1639.html
• https://access.redhat.com/errata/RHSA-2015:1639
• https://access.redhat.com/security/cve/CVE-2015-5163
• https://bugzilla.redhat.com/show_bug.cgi?id=1252378
• https://web.archive.org/web/20200228024903/http://www.securityfocus.com/bid/76346
• https://github.com/openstack/glance/commit/eb99e45829a1b4c93db5692bdbf636a86faa56c4
• https://github.com/advisories/GHSA-q73f-vjc2-3gqf

Repository: https://github.com/openstack/glance
Blast Radius: 0.0

Affected Packages