PT-2015-4312 · Openstack · Openstack Glance

Tushar Patil · Publicado 2015-01-23 · Atualizado 2022-05-17 · CVE-2014-9623

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Glance versions 2014.2.x through 2014.2.1 OpenStack Glance version 2014.1.3 and earlier

Description The issue allows remote authenticated users to bypass the storage quota, causing a denial of service due to disk consumption. This occurs when an image in the saving state is deleted.

Recommendations For OpenStack Glance versions 2014.2.x through 2014.2.1, update to a version that fixes the quota bypass issue to prevent denial of service. For OpenStack Glance version 2014.1.3 and earlier, update to a version that fixes the quota bypass issue to prevent denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2014-9623

GHSA-J4MH-9WQ6-8RG6

RHSA-2015:0644

RHSA-2015:0837

RHSA-2015:0838

Produtos afetados

Openstack Glance

Referências · 18

• 🔥 https://bugs.launchpad.net/glance/+bug/1398830 · Exploit
• https://github.com/openstack/glance · Nota
• https://github.com/openstack/glance/commit/7d5d8657fd70b20518610b3c6f8e41e16c72fa31 · Nota
• https://github.com/openstack/glance/commit/0dc8fbb3479a53c5bba8475d14f4c7206904c5ea · Nota
• https://github.com/openstack/glance/commit/f1260cc771ee068651aa62b972bef49d9af81eb0 · Nota
• http://openwall.com/lists/oss-security/2015/01/18/4 · Nota
• http://rhn.redhat.com/errata/RHSA-2015-0644.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-9623 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-j4mh-9wq6-8rg6 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-9623 · Aviso do Fabricante
• https://bugs.launchpad.net/glance/+bug/1383973 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-9623 · Nota de Segurança
• http://secunia.com/advisories/62165 · Nota
• http://oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html · Nota
• http://rhn.redhat.com/errata/RHSA-2015-0837.html · Aviso do Fabricante