PT-2015-6833 · Openstack+1 · Openstack Image Service+1

Alexei Galkin + 1 · Publicado 2015-10-26 · Atualizado 2023-02-12 · CVE-2015-5286

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenStack Image Service (Glance) versions prior to 2014.2.4 (juno) OpenStack Image Service (Glance) versions prior to 2015.1.2 (kilo)

Description The issue allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process.

Recommendations For versions prior to 2014.2.4 (juno), update to version 2014.2.4 or later. For versions prior to 2015.1.2 (kilo), update to version 2015.1.2 or later.

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

CWE-264

Identificadores relacionados

CVE-2015-5286

GHSA-GVJG-R9FV-7QX9

RHSA-2015:1897

SUSE-SU-2016:0101-1

USN-3446-1

Produtos afetados

Openstack Image Service

Ubuntu

Referências · 33

• https://nvd.nist.gov/vuln/detail/CVE-2015-5286 · Nota de Segurança
• https://rhn.redhat.com/errata/RHSA-2015-1897.html · Nota
• https://web.archive.org/web/20200228024859/http://securityfocus.com/bid/76943 · Nota
• https://suse.com/security/cve/CVE-2015-5251 · Nota
• https://bugzilla.suse.com/945994 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5251 · Nota de Segurança
• https://bugzilla.suse.com/945051 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2016:0101-1 · Aviso do Fabricante
• https://opendev.org/openstack/glance · Nota
• https://osv.dev/vulnerability/USN-3446-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5286 · Nota de Segurança
• https://bugzilla.suse.com/947735 · Nota
• http://rhn.redhat.com/errata/RHSA-2015-1897.html · Aviso do Fabricante
• http://securityfocus.com/bid/76943 · Nota
• https://ubuntu.com/security/CVE-2015-5251 · Aviso do Fabricante