PT-2015-6137 · Openstack · Openstack Glance

Abhishek Kekane + 1 · Publicado 2015-08-14 · Atualizado 2016-12-03 · CVE-2015-3289

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Glance versions prior to 2015.1.1 (kilo)

Description The issue allows remote authenticated users to cause a denial of service by consuming disk space. This is achieved by repeatedly using the import task flow API to create images and then deleting them.

Recommendations For versions prior to 2015.1.1 (kilo), update to version 2015.1.1 (kilo) or later to resolve the issue. As a temporary workaround, consider restricting access to the import task flow API to minimize the risk of exploitation.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2015-3289

Produtos afetados

Openstack Glance

Referências · 7

• https://security-tracker.debian.org/tracker/CVE-2015-3289 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2015-3289 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-3289 · Aviso do Fabricante
• http://lists.openstack.org/pipermail/openstack-announce/2015-July/000481.html · Aviso do Fabricante
• https://bugs.launchpad.net/glance/+bug/1454087 · Correção
• http://securityfocus.com/bid/76068 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-3289 · Nota de Segurança