PYSEC-2017-143

vendorUSosv

view advisory published 2017-03-29Licence: CC-BY-4.0

The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted image, which triggers an MD5 collision.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2015-8234US	medium5.5	1.26% (70th)	—	2017-03-29
The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted image, which triggers an MD5 collision.

references

External citations — patches, advisories, analysis.

http://seclists.org/oss-sec/2015/q4/303WEB
https://bugs.launchpad.net/glance/+bug/1516031WEB
https://wiki.openstack.org/wiki/OSSN/OSSN-0061WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan