GitHub Advisoryadvisory · PyPI
GHSA-pwrj-f53c-f89j OpenStack Glance v2 API unrestricted path traversal through filesystem:// scheme
MEDIUM
Official page ↗
- Aliases
- CVE-2015-1195
- Ecosystem
- PyPI
- Packages
- glance
- Severity
- Moderate
- Weaknesses
- CWE-22
- Reviewed
- 2024-05-14
Affected packages
• PyPI glance: < 11.0.0a0 → fixed in 11.0.0a0
Description
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a `filesystem://` URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.
Related
Alias · CVE (1)
- CVE-2015-1195 The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote… vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-1195 advisory
- https://github.com/openstack/glance/commit/5191ed1879c5fd5b2694f922bcedec232f461088 web
- https://github.com/openstack/glance/commit/7d3a1db33ccbd25b9fc7326ce3468eabd2a41a99 web
- https://github.com/openstack/glance/commit/a2d986b976e9325a272e2d422465165315d19fe6 web
- https://bugs.launchpad.net/ossa/+bug/1408663 web
- https://github.com/openstack/glance package
- http://lists.openstack.org/pipermail/openstack-announce/2015-January/000325.html web
- http://secunia.com/advisories/62169 web
- http://www.openwall.com/lists/oss-security/2015/01/15/2 web
- http://www.openwall.com/lists/oss-security/2015/01/18/5 web
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html web
- http://www.securityfocus.com/bid/71976 web