PYSEC-2015-39

vendorUSosv

view advisory published 2015-08-19Licence: CC-BY-4.0

The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2015-5163US	low3.5	1.50% (74th)	—	2015-08-19
The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a c…

references

External citations — patches, advisories, analysis.

http://lists.openstack.org/pipermail/openstack-announce/2015-August/000527.htmlWEB
http://rhn.redhat.com/errata/RHSA-2015-1639.htmlADVISORY
http://www.securityfocus.com/bid/76346WEB
https://bugs.launchpad.net/glance/+bug/1471912WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan