GHSA-4jp4-3c62-r8jv

OpenStack Glance Denial of service by creating a large number of images

Source: GitHub Advisory Database (reviewed) High CVE-2015-1881

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	glance	< 11.0.0a0	11.0.0a0

Details

As written in the advisory (Markdown source, shown as plain text).

OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them, a different vulnerability than CVE-2014-9684.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2015-1881 advisory
https://github.com/openstack/glance/commit/25a722e614eacc47e4658f0bca6343fa52f7d03f web
https://github.com/openstack/glance/commit/78b5b0a9575cd5e9c4543ec0e8fd6072af1f0ebb web
https://bugs.launchpad.net/glance/+bug/1420696 web
https://github.com/openstack/glance package
https://github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2015-38.yaml web
http://lists.openstack.org/pipermail/openstack-announce/2015-February/000336.html web
http://rhn.redhat.com/errata/RHSA-2015-0938.html web