GHSA-q73f-vjc2-3gqf

OpenStack Image Service (Glance) allows remote authenticated users to read arbitrary file

Source: GitHub Advisory Database (reviewed) High CVE-2015-5163

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	glance	>= 2015.1.0, < 2015.1.2	2015.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2015-5163 advisory
https://github.com/openstack/glance/commit/eb99e45829a1b4c93db5692bdbf636a86faa56c4 web
https://access.redhat.com/errata/RHSA-2015:1639 web
https://access.redhat.com/security/cve/CVE-2015-5163 web
https://bugs.launchpad.net/glance/+bug/1471912 web
https://bugzilla.redhat.com/show_bug.cgi?id=1252378 web
https://github.com/openstack/glance package
https://github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2015-39.yaml web
https://web.archive.org/web/20200228024903/http://www.securityfocus.com/bid/76346 web
http://lists.openstack.org/pipermail/openstack-announce/2015-August/000527.html web
http://rhn.redhat.com/errata/RHSA-2015-1639.html web