GHSA-wmhw-fvg9-87fc

OpenStack Glance Signature Verification Bypass

Source: GitHub Advisory Database (reviewed) Moderate CVE-2015-8234

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	glance	<= 11.0.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted image, which triggers an MD5 collision.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2015-8234 advisory
https://bugs.launchpad.net/glance/+bug/1516031 web
https://github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2017-143.yaml web
https://seclists.org/oss-sec/2015/q4/303 web
https://wiki.openstack.org/wiki/OSSN/OSSN-0061 web
http://seclists.org/oss-sec/2015/q4/303 web