CVE-2014-5356 OpenStack Glance improper validation of the image_size_cap configuration option
MediumCVSS 4.0
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi glance(PyPI) | < 11.0.0a0 | 11.0.0a0 |
| debian/glance(Debian:12) | < 2014.1.3-1 | 2014.1.3-1 |
| debian/glance(Debian:13) | < 2014.1.3-1 | 2014.1.3-1 |
| debian/glance(Debian:14) | < 2014.1.3-1 | 2014.1.3-1 |
| OpenStack image registry and delivery service glance | <= 2013.2.3 | No fix listed |
| OpenStack image registry and delivery service glance | = 2013.2 | No fix listed |
| OpenStack image registry and delivery service glance | = 2013.2.1 | No fix listed |
| OpenStack image registry and delivery service glance | = 2013.2.2 | No fix listed |
| OpenStack image registry and delivery service glance | = 2014.1 | No fix listed |
| OpenStack image registry and delivery service glance | = 2014.1.1 | No fix listed |
| OpenStack image registry and delivery service glance | = 2014.1.2 | No fix listed |
| OpenStack image registry and delivery service glance | = juno-1 | No fix listed |
| OpenStack image registry and delivery service glance | = juno-2 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- bugs.launchpad.net
- github.com product
- RHSA-2014:1337 vendor-advisory
- RHSA-2014:1338 vendor-advisory
- RHSA-2014:1685 vendor-advisory
- 60743 third-party-advisory
- [oss-security] 20140821 [OSSA 2014-028] Glance store DoS through disk space exhaustion (CVE-2014-5356) mailing-list
- USN-2322-1 vendor-advisory
- pypi.org product
- github.com vendor-advisory
- Debian Security Tracker CVE-2014-5356 vendor-advisory