PT-2015-4312 · Openstack · Openstack Glance

Tushar Patil · Published 2015-01-23 · Updated 2022-05-17 · CVE-2014-9623

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Glance versions 2014.2.x through 2014.2.1 OpenStack Glance version 2014.1.3 and earlier

Description The issue allows remote authenticated users to bypass the storage quota, causing a denial of service due to disk consumption. This occurs when an image in the saving state is deleted.

Recommendations For OpenStack Glance versions 2014.2.x through 2014.2.1, update to a version that fixes the quota bypass issue to prevent denial of service. For OpenStack Glance version 2014.1.3 and earlier, update to a version that fixes the quota bypass issue to prevent denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2014-9623

GHSA-J4MH-9WQ6-8RG6

RHSA-2015:0644

RHSA-2015:0837

RHSA-2015:0838

Affected Products

Openstack Glance

References · 18

• 🔥 https://bugs.launchpad.net/glance/+bug/1398830 · Exploit
• http://rhn.redhat.com/errata/RHSA-2015-0644.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-9623 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j4mh-9wq6-8rg6 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-9623 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9623 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-0837.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0838.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-9623 · Vendor Advisory
• https://github.com/openstack/glance · Note
• https://github.com/openstack/glance/commit/7d5d8657fd70b20518610b3c6f8e41e16c72fa31 · Note
• https://github.com/openstack/glance/commit/0dc8fbb3479a53c5bba8475d14f4c7206904c5ea · Note
• https://github.com/openstack/glance/commit/f1260cc771ee068651aa62b972bef49d9af81eb0 · Note
• http://openwall.com/lists/oss-security/2015/01/18/4 · Note
• https://bugs.launchpad.net/glance/+bug/1383973 · Note