PT-2013-3424 · Openstack · Openstack Glance

Stuart Mclaren · Publicado 2013-03-22 · Atualizado 2022-05-17 · CVE-2013-1840

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Glance versions 2012.1 through 2012.2, Grizzly

Description The issue in OpenStack Glance allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image when using the single-tenant Swift or S3 store. This occurs because the v1 API reports the location field.

Recommendations For OpenStack Glance versions 2012.1 through 2012.2, consider restricting access to the v1 API until a fix is available. For OpenStack Glance Grizzly, avoid using the single-tenant Swift or S3 store with the v1 API until the issue is resolved. As a temporary workaround, consider disabling the use of the location field in the v1 API for cached images.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2013-1840

GHSA-C8W9-83VG-R8VV

PYSEC-2013-46

RHSA-2013:0707

Produtos afetados

Openstack Glance

Referências · 22

• https://github.com/openstack/glance · Nota
• https://github.com/openstack/glance/commit/dd849a9be540bedd4fd904cc0b86ccd9c3e34af2 · Nota
• https://github.com/openstack/glance/commit/74b067df9726f9cf3e6e17e248719794a6ee0745 · Nota
• https://github.com/openstack/glance/commit/e75764eee34915f8bc5b664ac18e47a556c9d3dd · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2013-46.yaml · Nota
• https://review.openstack.org/#/c/24437 · Nota
• https://review.openstack.org/#/c/24438 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/82878 · Nota
• http://rhn.redhat.com/errata/RHSA-2013-0707.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2013-1840 · Aviso do Fabricante
• http://secunia.com/advisories/52565 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/03/14/15 · Nota
• http://osvdb.org/91304 · Nota
• https://review.openstack.org/#/c/24439 · Nota
• http://securityfocus.com/bid/58490 · Nota