PT-2013-3424 · Openstack · Openstack Glance

Stuart Mclaren · Published 2013-03-22 · Updated 2022-05-17 · CVE-2013-1840

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Glance versions 2012.1 through 2012.2, Grizzly

Description The issue in OpenStack Glance allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image when using the single-tenant Swift or S3 store. This occurs because the v1 API reports the location field.

Recommendations For OpenStack Glance versions 2012.1 through 2012.2, consider restricting access to the v1 API until a fix is available. For OpenStack Glance Grizzly, avoid using the single-tenant Swift or S3 store with the v1 API until the issue is resolved. As a temporary workaround, consider disabling the use of the location field in the v1 API for cached images.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-1840

GHSA-C8W9-83VG-R8VV

PYSEC-2013-46

RHSA-2013:0707

Affected Products

Openstack Glance

References · 22

• http://rhn.redhat.com/errata/RHSA-2013-0707.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-1840 · Vendor Advisory
• http://secunia.com/advisories/52565 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1840 · Security Note
• http://ubuntu.com/usn/USN-1764-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c8w9-83vg-r8vv · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1840 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2013-46 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-1840 · Vendor Advisory
• https://github.com/openstack/glance · Note
• https://github.com/openstack/glance/commit/dd849a9be540bedd4fd904cc0b86ccd9c3e34af2 · Note
• https://github.com/openstack/glance/commit/74b067df9726f9cf3e6e17e248719794a6ee0745 · Note
• https://github.com/openstack/glance/commit/e75764eee34915f8bc5b664ac18e47a556c9d3dd · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2013-46.yaml · Note
• https://review.openstack.org/#/c/24437 · Note