Date: Mon, 5 Jan 2015 10:25:55 -0800 From: Grant Murphy <grant.murphy@...com> To: oss-security@...ts.openwall.com Subject: [OSSA 2014-041.1] Glance v2 API unrestricted path traversal (CVE-2014-9493) ERRATA 1 OpenStack Security Advisory: 2014-041 (ERRATA 1) CVE: CVE-2014-9493 Date: January 5, 2015 Title: Glance v2 API unrestricted path traversal Reporter: Masahito Muroi (NTT) Products: Glance Versions: up to 2014.1.3 and 2014.2 version up to 2014.2.1 Description: Masahito Muroi from NTT reported a vulnerability in Glance. By setting a malicious image location an authenticated user can download or delete any file on the Glance server for which the Glance process user has access to. Only setups using the Glance V2 API are affected by this flaw. Errata: When the original advisory was published a CVE number was not assigned. CVE-2014-9493 can now be used to track this vulnerability. Kilo (development branch) fix: https://review.openstack.org/141706 Juno fix: https://review.openstack.org/142373 Icehouse fix: https://review.openstack.org/142788 Notes: * This fix was included in the kilo-1 development milestone and will be included in future 2014.2.2 (juno) and 2014.1.4 (icehouse) releases. * The OpenStack VMT recommends revoking all credentials stored in files accessible by Glance as a precautionary measure. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9493 https://launchpad.net/bugs/1400966 OSSA History: 2015-01-05 - Errata 1 2014-12-23 - Original Version -- Grant Murphy OpenStack Vulnerability Management Team Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.