GitHub Advisoryadvisory · PyPI

GHSA-g2j5-7vgx-6xrx OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption

HIGH Published 2022-05-14 Modified 2023-02-03 Official page ↗
Aliases
CVE-2015-5162
Ecosystem
PyPI
Packages
cinder, glance, nova
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2023-02-03

Affected packages

• PyPI cinder: < 7.0.2 → fixed in 7.0.2 • PyPI cinder: >= 8.0.0, < 9.0.0 → fixed in 9.0.0 • PyPI glance: < 14.0.0 → fixed in 14.0.0 • PyPI nova: < 12.0.4 → fixed in 12.0.4

Description

The image parser in OpenStack Cinder prior to 7.0.2, and 8.0.0 and above, prior to 9.0.0; Glance prior to 14.00; and Nova prior to 12.0.4 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image. This issue is patched in Cinder 7.0.2 and 9.0.0; Glance 14.0.0; and Nova 12.0.4

Related

Alias · CVE (1)

  • CVE-2015-5162 The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References