PT-2016-4404 · Openstack+1 · Openstack Image Service+1

Erno Kuvaja · Published 2016-04-13 · Updated 2023-03-07 · CVE-2016-0757

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Image Service (Glance) versions prior to 2015.1.3 (kilo) OpenStack Image Service (Glance) versions 11.0.x prior to 11.0.2 (liberty)

Description The issue allows remote authenticated users to tamper with images, potentially compromising the integrity of virtual machines created using these modified images. This is possible when the show multiple locations feature is enabled, allowing attackers to change image status and upload new image data by removing the last location of an image.

Recommendations For OpenStack Image Service (Glance) versions prior to 2015.1.3 (kilo), update to version 2015.1.3 or later. For OpenStack Image Service (Glance) versions 11.0.x prior to 11.0.2 (liberty), update to version 11.0.2 or later. As a temporary workaround, consider disabling the show multiple locations feature until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

CWE-829

Related Identifiers

CVE-2016-0757

GHSA-5GP5-VXJ6-4257

GHSA-5XRJ-GHHP-HX7P

RHSA-2016:0309

RHSA-2016:0352

RHSA-2016:0354

RHSA-2016:0358

USN-3446-1

Affected Products

Openstack Image Service

Ubuntu

References · 31

• https://nvd.nist.gov/vuln/detail/CVE-2022-4134 · Security Note
• http://rhn.redhat.com/errata/RHSA-2016-0309.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3446-1 · Vendor Advisory
• https://security.openstack.org/ossa/OSSA-2016-006.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-0757 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0757 · Security Note
• https://cve.org/CVERecord?id=CVE-2016-0757 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-0757 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-0757 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5xrj-ghhp-hx7p · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5251 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3446-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5gp5-vxj6-4257 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-0757 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5286 · Vendor Advisory