CVE-2015-5286
Published: 26 October 2015
OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
glance Launchpad, Ubuntu, Debian |
precise |
Ignored
(end of life)
|
| trusty |
Released
(1:2014.1.5-0ubuntu1.1)
|
|
| upstream |
Needs triage
|
|
| vivid |
Not vulnerable
(1:2015.1.2-0ubuntu1)
|
|
| wily |
Not vulnerable
(2:11.0.0-0ubuntu1)
|
|
| xenial |
Not vulnerable
(2:11.0.0-0ubuntu1)
|
|
| yakkety |
Not vulnerable
(2:11.0.0-0ubuntu1)
|
|
| zesty |
Not vulnerable
(2:11.0.0-0ubuntu1)
|
|
|
Patches: upstream: https://review.openstack.org/229946 upstream: https://review.openstack.org/229975 upstream: https://review.openstack.org/229945 upstream: https://review.openstack.org/229973 upstream: https://review.openstack.org/230056 upstream: https://review.openstack.org/229972 upstream: https://review.openstack.org/229943 upstream: https://review.openstack.org/229971 vendor: http://ftp.redhat.com/pub/redhat/linux/enterprise/7Server/en/RHOS/SRPMS/openstack-glance-2014.1.5-5.el7ost.src.rpm |
||