PT-2013-5012 · Openstack · Openstack Image Registry/Delivery Service

Stuart Mclaren + 1 · Published 2013-10-27 · Updated 2018-11-15 · CVE-2013-4428

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Image Registry and Delivery Service (Glance) versions Folsom through Grizzly before 2013.1.4 OpenStack Image Registry and Delivery Service (Glance) version Havana before 2013.2

Description The issue allows remote authenticated users to read otherwise restricted images via an image UUID, due to improper access restriction to cached images when the download image policy is configured.

Recommendations For OpenStack Image Registry and Delivery Service (Glance) versions Folsom through Grizzly before 2013.1.4, update to version 2013.1.4 or later. For OpenStack Image Registry and Delivery Service (Glance) version Havana before 2013.2, update to version 2013.2 or later.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-4428

RHSA-2013:1525

Affected Products

Openstack Image Registry/Delivery Service

References · 13

• 🔥 https://bugs.launchpad.net/glance/+bug/1235226 · Exploit
• 🔥 https://bugs.launchpad.net/glance/+bug/1235378 · Exploit
• http://ubuntu.com/usn/USN-2003-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-4428 · Vendor Advisory
• https://launchpad.net/glance/+milestone/2013.2 · Patch
• https://osv.dev/vulnerability/CVE-2013-4428 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4428 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-1525.html · Vendor Advisory
• https://launchpad.net/glance/+milestone/2013.1.4 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4428 · Vendor Advisory
• http://openwall.com/lists/oss-security/2013/10/15/8 · Note
• http://openwall.com/lists/oss-security/2013/10/16/9 · Note
• http://securityfocus.com/bid/63159 · Note