CVE-2013-1840 Openstack glance: swift: s3: openstack glance: information disclosure of backend credentials via cached image request
MediumCVSS 6.5
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the disclosure of the operator's backend credentials.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi glance(PyPI) | < 11.0.0a0 | 11.0.0a0 |
| pypi glance(PyPI) | <= v1 | No fix listed |
| debian/glance(Debian:12) | < 2012.1.1-5 | 2012.1.1-5 |
| debian/glance(Debian:13) | < 2012.1.1-5 | 2012.1.1-5 |
| debian/glance(Debian:14) | < 2012.1.1-5 | 2012.1.1-5 |
| redhat openstack | < 0:2012.2.3-8.el6ost | 0:2012.2.3-8.el6ost |
| redhat openstack | = 16.2 | No fix listed |
| redhat openstack | = 17.1 | No fix listed |
| redhat openstack | = 18.0 | No fix listed |
| OpenStack Glance | = v1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- bugs.launchpad.net
- openstack-glance-api-info-disclosure(82878) vdb-entry
- github.com product
- github.com
- review.openstack.org
- 91304 vdb-entry
- RHSA-2013:0707 vendor-advisory
- 52565 third-party-advisory vendor-advisory
- [oss-security] 20130314 [OSSA 2013-007] Backend credentials leak in Glance v1 API (CVE-2013-1840) mailing-list
- 58490 vdb-entry
- USN-1764-1 vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2013-1840 vendor-advisory
- RHSA-2013:0707 vendor-advisory
- access.redhat.com vdb-entry
- bugs.debian.org issue-tracking