OpenStack Image Service (Glance) allows remote authenticated users to read arbitrary file
The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2015-5163US | low3.5 | — | ||
The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a c… | ||||
02
references
External citations — patches, advisories, analysis.
- http://lists.openstack.org/pipermail/openstack-announce/2015-August/000527.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-1639.htmlWEB
- https://access.redhat.com/errata/RHSA-2015:1639WEB
- https://access.redhat.com/security/cve/CVE-2015-5163WEB
- https://bugs.launchpad.net/glance/+bug/1471912WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1252378WEB
- https://github.com/openstack/glancePACKAGE
- https://github.com/openstack/glance/commit/eb99e45829a1b4c93db5692bdbf636a86faa56c4WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan