[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 22 Dec 2014 07:20:59 -0800
From: Grant Murphy <grant.murphy@...com>
To: oss-security@...ts.openwall.com
Subject: [grant.murphy@...com: CVE request for vulnerability
in OpenStack Glance]
Just wondering if this has been missed? All changes have been merged and
we are just waiting on a CVE id. The OpenStack VMT consider this to be a
critical issue.
- Grant
----- Forwarded message from "Murphy, Grant Charles" <grant.murphy@...com> -----
> Date: Mon, 15 Dec 2014 18:00:53 +0000
> From: "Murphy, Grant Charles" <grant.murphy@...com>
> To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
> Subject: [oss-security] CVE request for vulnerability in OpenStack Glance
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> A vulnerability was discovered in OpenStack (see below). In order to ensure full traceability, we need a CVE number assigned that we can attach to further notifications. This issue is already public, although an advisory was not sent yet.
>
> Title: Glance v2 API unrestricted path traversal
> Reporter: Masahito Muroi (NTT)
> Products: Glance
> Versions: up to 2014.1.3 and 2014.2 version up to 2014.2.1
>
> Description:
> Masahito Muroi from NTT reported a vulnerability in Glance. By setting a malicious image location an authenticated user can download or delete any file on the Glance server for which the Glance process user has access to. Only setups using the Glance V2 API are affected by this flaw.
>
> References:
> https://launchpad.net/bugs/1400966
>
> Thanks in advance,
>
> Grant Murphy
> OpenStack Vulnerability Management Team
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iQEcBAEBAgAGBQJUjyEvAAoJEJ3kO55VGiJS2ZwH/RmVDlq6ZycvDB+TRicOf1Ho
> kam2t/cc/4fvaZN1BYTrcjaPn+HK9ETdNdh3cHwiC6UYgtEa7Gb3IiboY4fK/7Si
> hrVdgdOWRB+I3dkGrHb+kAaWNGSKJoHahq3mQ5NuXg+oFjR42caslX3vn2f8tBnA
> Ybgqvelu5S1ht5x4XBoagmb0gSafp6a4xik4cwf0FkbkqCnO/EE5beHVSYXu4aVG
> VLGtgd3+l6EjvMoSKXkWKAGwMC1fLCV+ISr1e4CBng5EGSqFmiTYZghQ0e5mvO2q
> 4QgEqAgUl1DwpRJYyNeS3dHILA32Nuu0NEKvGn61AdXzxfMZpok1GwLPTq+DWyk=
> =meRY
> -----END PGP SIGNATURE-----
>
----- End forwarded message -----
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
