Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 23 Dec 2014 07:26:22 -0800
From: Grant Murphy <>
Subject: [OSSA-2014-041] Glance v2 API unrestricted path traversal

OpenStack Security Advisory: 2014-041 
CVE: Requested
Date: December 23, 2014
Title: Glance v2 API unrestricted path traversal
Reporter: Masahito Muroi (NTT)
Products: Glance
Versions: up to 2014.1.3 and 2014.2 version up to 2014.2.1

Masahito Muroi from NTT reported a vulnerability in Glance. By setting 
a malicious image location an authenticated user can download or delete
any file on the Glance server for which the Glance process user has 
access to. Only setups using the Glance V2 API are affected by this flaw.

Kilo (development branch) fix:

Juno fix:

Icehouse fix:

 * This fix was included in the kilo-1 development milestone and will be included
   in future 2014.2.2 (juno) and 2014.1.4 (icehouse) releases.

 * The OpenStack VMT recommends revoking all credentials stored in files
   accessible by Glance as a precautionary measure. 

 * A CVE has been requested for this issue, the OpenStack VMT will issue an 
   errata with the correct CVE number assigned once this information is available.


Grant Murphy
OpenStack Vulnerability Management Team

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.