PT-2013-4968 · Openstack+1 · Openstack Image Registry/Delivery Service+1

Flaper87 + 1 · Publicado 2013-11-23 · Atualizado 2013-11-25 · CVE-2013-4354

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Image Registry and Delivery Service (Glance) versions prior to 2.1

Description The issue allows local users to more easily inject images into arbitrary tenants by adding the tenant as a member of the image. This is due to a problem in the API.

Recommendations For versions prior to 2.1, update to version 2.1 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-4354

Produtos afetados

Debian

Openstack Image Registry/Delivery Service

Referências · 10

• http://openwall.com/lists/oss-security/2013/09/19/3 · Nota
• https://security-tracker.debian.org/tracker/source-package/glance · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/09/19/2 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4354 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2013-4354 · Aviso do Fabricante
• https://packages.debian.org/src:glance · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4354 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4354 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2013-4354 · Aviso do Fabricante
• https://bugs.launchpad.net/glance/+bug/1226078 · Nota