PT-2015-6137 · Openstack · Openstack Glance

Abhishek Kekane + 1 · Published 2015-08-14 · Updated 2016-12-03 · CVE-2015-3289

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Glance versions prior to 2015.1.1 (kilo)

Description The issue allows remote authenticated users to cause a denial of service by consuming disk space. This is achieved by repeatedly using the import task flow API to create images and then deleting them.

Recommendations For versions prior to 2015.1.1 (kilo), update to version 2015.1.1 (kilo) or later to resolve the issue. As a temporary workaround, consider restricting access to the import task flow API to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2015-3289

Affected Products

Openstack Glance

References · 7

• https://security-tracker.debian.org/tracker/CVE-2015-3289 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-3289 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-3289 · Vendor Advisory
• http://lists.openstack.org/pipermail/openstack-announce/2015-July/000481.html · Vendor Advisory
• https://bugs.launchpad.net/glance/+bug/1454087 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-3289 · Security Note
• http://securityfocus.com/bid/76068 · Note