GitHub Advisoryadvisory · PyPI

GHSA-4jp4-3c62-r8jv OpenStack Glance Denial of service by creating a large number of images

HIGH Published 2022-05-17 Modified 2024-11-26 Official page ↗
Aliases
CVE-2015-1881
Ecosystem
PyPI
Packages
glance
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2024-05-14

Affected packages

• PyPI glance: < 11.0.0a0 → fixed in 11.0.0a0

Description

OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them, a different vulnerability than CVE-2014-9684.

Related

Alias · CVE (1)

  • CVE-2015-1881 OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References