GHSA-5gp5-vxj6-4257

OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability

Source: GitHub Advisory Database (reviewed) Low CVE-2022-4134

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	glance	<= 25.1.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2016-0757 advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-4134 advisory
https://bugs.launchpad.net/glance/+bug/1990157 web
https://bugzilla.redhat.com/show_bug.cgi?id=2147462 web
https://github.com/openstack/glance package
https://github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2023-270.yaml web
https://wiki.openstack.org/wiki/OSSN/OSSN-0090 web