CVE-2015-5251 OpenStack Image Service (Glance) allows remote authenticated users to bypass access restrictions
MediumCVSS 5.5
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi glance(PyPI) | >= 2011.2, < 2014.2.4 | 2014.2.4 |
| pypi glance(PyPI) | >= 2015.1.0, < 2015.1.2 | 2015.1.2 |
| debian/glance(Debian:12) | < 1:11.0.0-1 | 1:11.0.0-1 |
| debian/glance(Debian:13) | < 1:11.0.0-1 | 1:11.0.0-1 |
| debian/glance(Debian:14) | < 1:11.0.0-1 | 1:11.0.0-1 |
| OpenStack image registry and delivery service glance | <= 2014.2.3 | No fix listed |
| OpenStack image registry and delivery service glance | = 2015.1.0 | No fix listed |
| OpenStack image registry and delivery service glance | = 2015.1.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- access.redhat.com
- access.redhat.com
- bugs.launchpad.net
- bugzilla.redhat.com
- opendev.org product
- rhn.redhat.com
- security.openstack.org vendor-advisory
- pypi.org product
- github.com vendor-advisory
- Debian Security Tracker CVE-2015-5251 vendor-advisory
- RHSA-2015:1897 vendor-advisory
- bugs.debian.org issue-tracking