PT-2015-6790 · Openstack · Openstack Image Service

Eharney + 1 · Published 2015-08-19 · Updated 2023-02-13 · CVE-2015-5163

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Image Service (Glance) versions 2015.1.x before 2015.1.2 (kilo)

Description The issue allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image when using the V2 API.

Recommendations For OpenStack Image Service (Glance) versions 2015.1.x before 2015.1.2 (kilo), update to version 2015.1.2 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-5163

GHSA-Q73F-VJC2-3GQF

PYSEC-2015-39

RHSA-2015:1639

Affected Products

Openstack Image Service

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2015-5163 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-1639.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-5163 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5163 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-5163 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2015-39 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q73f-vjc2-3gqf · Vendor Advisory
• https://github.com/openstack/glance · Note
• https://github.com/openstack/glance/commit/eb99e45829a1b4c93db5692bdbf636a86faa56c4 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2015-39.yaml · Note
• https://access.redhat.com/security/cve/CVE-2015-5163 · Note
• http://securityfocus.com/bid/76346 · Note
• http://lists.openstack.org/pipermail/openstack-announce/2015-August/000527.html · Note
• https://bugs.launchpad.net/glance/+bug/1471912 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1252378 · Note