GitHub Advisoryadvisory · PyPI

GHSA-h737-q6g6-8wr6 OpenStack Glance Denial of service by creating a large number of images

HIGH Published 2022-05-17 Modified 2024-11-26 Official page ↗
Aliases
CVE-2014-9684
Ecosystem
PyPI
Packages
glance
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2024-05-14

Affected packages

• PyPI glance: < 11.0.0a0 → fixed in 11.0.0a0

Description

OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.

Related

Alias · CVE (1)

  • CVE-2014-9684 OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References