GitHub Advisoryadvisory · PyPI

GHSA-gvjg-r9fv-7qx9 OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service

MEDIUM Published 2022-05-17 Modified 2023-02-08 Official page ↗
Aliases
CVE-2015-5286
Ecosystem
PyPI
Packages
glance
Severity
Moderate
Weaknesses
CWE-400
Reviewed
2023-02-08

Affected packages

• PyPI glance: < 2014.2.4 → fixed in 2014.2.4 • PyPI glance: >= 2015.1.0, < 2015.1.2 → fixed in 2015.1.2

Description

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.

Related

Alias · CVE (1)

  • CVE-2015-5286 OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References