CVSS: 4.0EPSS: 1%CPEs: 6EXPL: 1CVE-2014-9623 – openstack-glance: user storage quota bypass
https://notcve.org/view.php?id=CVE-2014-9623
OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting an image in the saving state. OpenStack Glance 2014.2.x hasta la versión 2014.2.1, 2014.1.3 y versiones anteriores permite a usuarios remotos autenticados eludir la cuota de almacenamiento y causar una denegación de servicio (consumo de disco) mediante el borrado de una imagen en el estado de ahorro. A storage quota bypass flaw was found in OpenStack Image (glance). If an image was deleted while it was being uploaded, it would not count towards a user's quota. A malicious user could use this flaw to deliberately fill the backing store, and cause a denial of service. • http://rhn.redhat.com/errata/RHSA-2015-0644.html http://rhn.redhat.com/errata/RHSA-2015-0837.html http://rhn.redhat.com/errata/RHSA-2015-0838.html http://secunia.com/advisories/62165 http://www.openwall.com/lists/oss-security/2015/01/18/4 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html https://bugs.launchpad.net/glance/+bug/1383973 https://bugs.launchpad.net/glance/+bug/1398830 https://security.openstack.org/ossa/OSSA-2015-003.html https • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2015-1195
https://notcve.org/view.php?id=CVE-2015-1195
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493. La API V2 en OpenStack Image Registry and Delivery Service (Glance) anterior a 2014.1.4 y 2014.2.x anterior a 2014.2.2 permite a usuarios remotos autenticados leer o eliminar ficheros arbitrarios a través de un nombre de ruta completo en una URL filesystem: en la propiedad de la localización de imágenes. NOTA: esta vulnerabilidad existe debida a una soluciona incompleta para CVE-2014-9493. • http://lists.openstack.org/pipermail/openstack-announce/2015-January/000325.html http://secunia.com/advisories/62169 http://www.openwall.com/lists/oss-security/2015/01/15/2 http://www.openwall.com/lists/oss-security/2015/01/18/5 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.securityfocus.com/bid/71976 https://bugs.launchpad.net/ossa/+bug/1408663 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2014-9493 – openstack-glance: unrestricted path traversal flaw
https://notcve.org/view.php?id=CVE-2014-9493
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete arbitrary files via a full pathname in a file: URL in the image location property. La API V2 en OpenStack Image Registry and Delivery Service (Glance) anterior a 2014.2.2 y 2014.1.4 permite a usuarios remotos autenticados leer o eliminar ficheros a través de un nombre de ruta completo en un fichero: URL en la propiedad de la localización de imágenes. It was discovered that an authenticated user could use a path traversal flaw in glance to download or delete any file on the glance server that is accessible to the glance process user. Note that only setups using the OpenStack Image V2 API were affected by this flaw. • http://lists.openstack.org/pipermail/openstack-announce/2014-December/000317.html http://rhn.redhat.com/errata/RHSA-2015-0246.html http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.securityfocus.com/bid/71688 https://bugs.launchpad.net/glance/+bug/1400966 https://security.openstack.org/ossa/OSSA-2014-041.html https://access.redhat.com/security/cve/CVE-2014-9493 https://bugzilla.redhat.com/show_bug.cgi?id=1174474 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.0EPSS: 0%CPEs: 10EXPL: 0CVE-2014-5356 – openstack-glance: Glance store disk space exhaustion
https://notcve.org/view.php?id=CVE-2014-5356
OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image. OpenStack Image Registry and Delivery Service (Glance) anterior a 2013.2.4, 2014.x anterior a 2014.1.3, y Juno anterior a Juno-3, cuando utiliza la API V2, no aplica debidamente la opción de configuración image_size_cap, lo que permite a usuarios remotos autenticados causar una denegación de servicio (el consumo del disco) mediante la subida de un imagen grande. It was discovered that the image_size_cap configuration option in glance was not honored. An authenticated user could use this flaw to upload an image to glance and consume all available storage space, resulting in a denial of service. • http://rhn.redhat.com/errata/RHSA-2014-1337.html http://rhn.redhat.com/errata/RHSA-2014-1338.html http://rhn.redhat.com/errata/RHSA-2014-1685.html http://secunia.com/advisories/60743 http://www.openwall.com/lists/oss-security/2014/08/21/6 http://www.ubuntu.com/usn/USN-2322-1 https://bugs.launchpad.net/glance/+bug/1315321 https://access.redhat.com/security/cve/CVE-2014-5356 https://bugzilla.redhat.com/show_bug.cgi?id=1131770 • CWE-264: Permissions, Privileges, and Access Controls CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2014-0162 – openstack-glance: remote code execution in Glance Sheepdog backend
https://notcve.org/view.php?id=CVE-2014-0162
The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location. El backend Sheepdog en OpenStack Image Registry and Delivery Service (Glance) 2013.2 anterior a 2013.2.4 y icehouse anterior a icehouse-rc2 permite a usuarios remotos autenticados con permiso insertar o modificar un imagen para ejecutar comandos arbitrarios a través de una localización manipulada. • http://rhn.redhat.com/errata/RHSA-2014-0455.html http://www.openwall.com/lists/oss-security/2014/04/10/13 http://www.ubuntu.com/usn/USN-2193-1 https://launchpad.net/bugs/1298698 https://access.redhat.com/security/cve/CVE-2014-0162 https://bugzilla.redhat.com/show_bug.cgi?id=1085163 • CWE-20: Improper Input Validation CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •