CVE-2016-8611 A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 /images API POST method for authenticated users, resulting in possible denial o...
MediumCVSS 6.5
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 /images API POST method for authenticated users, resulting in possible denial of service attacks through database table saturation.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/glance(Debian:12) | All versions | No fix listed |
| debian/glance(Debian:12) | = 2:25.1.0-2 | No fix listed |
| debian/glance(Debian:12) | = 2:25.1.0-2+deb12u1 | No fix listed |
| debian/glance(Debian:12) | = 2:25.1.0-2+deb12u2 | No fix listed |
| debian/glance(Debian:12) | = 2:25.1.0-2+deb12u3 | No fix listed |
| debian/glance(Debian:12) | = 2:25.1.0-2+deb12u5 | No fix listed |
| debian/glance(Debian:12) | = 2:26.0.0-1 | No fix listed |
| debian/glance(Debian:12) | = 2:26.0.0-2 | No fix listed |
| debian/glance(Debian:12) | = 2:26.0.0-3 | No fix listed |
| debian/glance(Debian:12) | = 2:26.0.0-4 | No fix listed |
| debian/glance(Debian:12) | = 2:26.0.0~rc1-1 | No fix listed |
| debian/glance(Debian:12) | = 2:27.0.0-1 | No fix listed |
| debian/glance(Debian:12) | = 2:27.0.0-2 | No fix listed |
| debian/glance(Debian:12) | = 2:27.0.0~rc1-1 | No fix listed |
| debian/glance(Debian:12) | = 2:28.0.0~rc1-1 | No fix listed |
| debian/glance(Debian:12) | = 2:28.0.1-1 | No fix listed |
| debian/glance(Debian:12) | = 2:28.0.1-2 | No fix listed |
| debian/glance(Debian:12) | = 2:28.0.1-3 | No fix listed |
| debian/glance(Debian:12) | = 2:28.0.1-3+deb12u1 | No fix listed |
| debian/glance(Debian:12) | = 2:28.0.1-4 | No fix listed |
| debian/glance(Debian:12) | = 2:29.0.0-1 | No fix listed |
| debian/glance(Debian:12) | = 2:29.0.0-2 | No fix listed |
| debian/glance(Debian:12) | = 2:29.0.0-3 | No fix listed |
| debian/glance(Debian:12) | = 2:29.0.0-4 | No fix listed |
| debian/glance(Debian:12) | = 2:29.0.0~rc1-1 | No fix listed |
Show 88 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/glance(Debian:12) | = 2:29.0.0~rc1-2 | No fix listed |
| debian/glance(Debian:12) | = 2:30.0.0-1 | No fix listed |
| debian/glance(Debian:12) | = 2:30.0.0-3 | No fix listed |
| debian/glance(Debian:12) | = 2:30.0.0~rc1-1 | No fix listed |
| debian/glance(Debian:12) | = 2:30.0.0~rc1-2 | No fix listed |
| debian/glance(Debian:12) | = 2:31.0.0-1 | No fix listed |
| debian/glance(Debian:12) | = 2:31.0.0-2 | No fix listed |
| debian/glance(Debian:12) | = 2:31.0.0-3 | No fix listed |
| debian/glance(Debian:12) | = 2:31.0.0-4 | No fix listed |
| debian/glance(Debian:12) | = 2:31.0.0~rc1-1 | No fix listed |
| debian/glance(Debian:12) | = 2:31.0.0~rc1-2 | No fix listed |
| debian/glance(Debian:12) | = 2:32.0.0-1 | No fix listed |
| debian/glance(Debian:12) | = 2:32.0.0-2 | No fix listed |
| debian/glance(Debian:12) | = 2:32.0.0-3 | No fix listed |
| debian/glance(Debian:12) | = 2:32.0.0-4 | No fix listed |
| debian/glance(Debian:12) | = 2:32.0.0~rc1-1 | No fix listed |
| debian/glance(Debian:12) | = 2:32.0.0~rc1-2 | No fix listed |
| debian/glance(Debian:12) | = 2:32.0.0~rc1-3 | No fix listed |
| debian/glance(Debian:12) | = 2:32.0.0~rc1-4 | No fix listed |
| debian/glance(Debian:12) | = 2:32.0.0~rc2-1 | No fix listed |
| debian/glance(Debian:12) | = 2:32.0.0~rc2-2 | No fix listed |
| debian/glance(Debian:12) | = 2:33.0.0-1 | No fix listed |
| debian/glance(Debian:12) | = 2:33.0.0-2 | No fix listed |
| debian/glance(Debian:12) | = 2:33.0.0-3 | No fix listed |
| debian/glance(Debian:12) | = 2:33.0.0-4 | No fix listed |
| debian/glance(Debian:12) | = 2:33.0.0-5 | No fix listed |
| debian/glance(Debian:12) | = 2:33.0.0-6 | No fix listed |
| debian/glance(Debian:12) | = 2:33.0.0~rc1-1 | No fix listed |
| debian/glance(Debian:12) | = 2:33.0.0~rc1-2 | No fix listed |
| debian/glance(Debian:12) | = 2:33.0.0~rc1-3 | No fix listed |
| debian/glance(Debian:13) | All versions | No fix listed |
| debian/glance(Debian:13) | = 2:30.0.0-3 | No fix listed |
| debian/glance(Debian:13) | = 2:30.0.0-3+deb13u1 | No fix listed |
| debian/glance(Debian:13) | = 2:30.0.0-3+deb13u2 | No fix listed |
| debian/glance(Debian:13) | = 2:31.0.0-1 | No fix listed |
| debian/glance(Debian:13) | = 2:31.0.0-2 | No fix listed |
| debian/glance(Debian:13) | = 2:31.0.0-3 | No fix listed |
| debian/glance(Debian:13) | = 2:31.0.0-4 | No fix listed |
| debian/glance(Debian:13) | = 2:31.0.0~rc1-1 | No fix listed |
| debian/glance(Debian:13) | = 2:31.0.0~rc1-2 | No fix listed |
| debian/glance(Debian:13) | = 2:32.0.0-1 | No fix listed |
| debian/glance(Debian:13) | = 2:32.0.0-2 | No fix listed |
| debian/glance(Debian:13) | = 2:32.0.0-3 | No fix listed |
| debian/glance(Debian:13) | = 2:32.0.0-4 | No fix listed |
| debian/glance(Debian:13) | = 2:32.0.0~rc1-1 | No fix listed |
| debian/glance(Debian:13) | = 2:32.0.0~rc1-2 | No fix listed |
| debian/glance(Debian:13) | = 2:32.0.0~rc1-3 | No fix listed |
| debian/glance(Debian:13) | = 2:32.0.0~rc1-4 | No fix listed |
| debian/glance(Debian:13) | = 2:32.0.0~rc2-1 | No fix listed |
| debian/glance(Debian:13) | = 2:32.0.0~rc2-2 | No fix listed |
| debian/glance(Debian:13) | = 2:33.0.0-1 | No fix listed |
| debian/glance(Debian:13) | = 2:33.0.0-2 | No fix listed |
| debian/glance(Debian:13) | = 2:33.0.0-3 | No fix listed |
| debian/glance(Debian:13) | = 2:33.0.0-4 | No fix listed |
| debian/glance(Debian:13) | = 2:33.0.0-5 | No fix listed |
| debian/glance(Debian:13) | = 2:33.0.0-6 | No fix listed |
| debian/glance(Debian:13) | = 2:33.0.0~rc1-1 | No fix listed |
| debian/glance(Debian:13) | = 2:33.0.0~rc1-2 | No fix listed |
| debian/glance(Debian:13) | = 2:33.0.0~rc1-3 | No fix listed |
| debian/glance(Debian:14) | All versions | No fix listed |
| debian/glance(Debian:14) | = 2:30.0.0-3 | No fix listed |
| debian/glance(Debian:14) | = 2:31.0.0-1 | No fix listed |
| debian/glance(Debian:14) | = 2:31.0.0-2 | No fix listed |
| debian/glance(Debian:14) | = 2:31.0.0-3 | No fix listed |
| debian/glance(Debian:14) | = 2:31.0.0-4 | No fix listed |
| debian/glance(Debian:14) | = 2:31.0.0~rc1-1 | No fix listed |
| debian/glance(Debian:14) | = 2:31.0.0~rc1-2 | No fix listed |
| debian/glance(Debian:14) | = 2:32.0.0-1 | No fix listed |
| debian/glance(Debian:14) | = 2:32.0.0-2 | No fix listed |
| debian/glance(Debian:14) | = 2:32.0.0-3 | No fix listed |
| debian/glance(Debian:14) | = 2:32.0.0-4 | No fix listed |
| debian/glance(Debian:14) | = 2:32.0.0~rc1-1 | No fix listed |
| debian/glance(Debian:14) | = 2:32.0.0~rc1-2 | No fix listed |
| debian/glance(Debian:14) | = 2:32.0.0~rc1-3 | No fix listed |
| debian/glance(Debian:14) | = 2:32.0.0~rc1-4 | No fix listed |
| debian/glance(Debian:14) | = 2:32.0.0~rc2-1 | No fix listed |
| debian/glance(Debian:14) | = 2:32.0.0~rc2-2 | No fix listed |
| debian/glance(Debian:14) | = 2:33.0.0-1 | No fix listed |
| debian/glance(Debian:14) | = 2:33.0.0-2 | No fix listed |
| debian/glance(Debian:14) | = 2:33.0.0-3 | No fix listed |
| debian/glance(Debian:14) | = 2:33.0.0-4 | No fix listed |
| debian/glance(Debian:14) | = 2:33.0.0-5 | No fix listed |
| debian/glance(Debian:14) | = 2:33.0.0-6 | No fix listed |
| debian/glance(Debian:14) | = 2:33.0.0~rc1-1 | No fix listed |
| debian/glance(Debian:14) | = 2:33.0.0~rc1-2 | No fix listed |
| debian/glance(Debian:14) | = 2:33.0.0~rc1-3 | No fix listed |
| OpenStack Glance | All versions | No fix listed |
| The Openstack Foundation openstack-glance | = v1 and v2 | No fix listed |
References
- Debian Security Tracker CVE-2016-8611 vendor-advisory
- [oss-security] 20161027 [OSSN-0076] Glance Image service v1 and v2 api image-create vulnerability mailing-list third-party-advisory
- 94378 third-party-advisory vdb-entry
- 1037312 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking third-party-advisory
- h20566.www2.hpe.com vendor-advisory