CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2016-0757 – openstack-glance: Glance image status manipulation through locations
https://notcve.org/view.php?id=CVE-2016-0757
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image. OpenStack Image Service (Glance) en versiones anteriores a 2015.1.3 (kilo) y 11.0.x en versiones anteriores a 11.0.2 (liberty), cuando show_multiple_locations está habilitado, permiten a usuarios remotos autenticados cambiar el estado de imagen y cargar nuevos datos de imagen eliminando la última localización de una imagen. An authorization vulnerability in OpenStack Image service was discovered, which allowed image-status manipulation using locations. By removing the last location of an image, an authenticated user could change the status from 'active' to 'queue'. A malicious tenant could exploit this flaw to silently replace owned image data, regardless of its original creator or visibility settings. • http://rhn.redhat.com/errata/RHSA-2016-0309.html http://www.securityfocus.com/bid/82696 https://security.openstack.org/ossa/OSSA-2016-006.html https://access.redhat.com/security/cve/CVE-2016-0757 https://bugzilla.redhat.com/show_bug.cgi?id=1302607 • CWE-284: Improper Access Control CWE-285: Improper Authorization •
CVSS: 6.0EPSS: 0%CPEs: 3EXPL: 0CVE-2015-5251 – openstack-glance allows illegal modification of image status
https://notcve.org/view.php?id=CVE-2015-5251
OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*. OpenStack Image Service (Glance) en versiones anteriores a 2014.2.4 (juno) y 2015.1.x en versiones anteriores 2015.1.2 (kilo) permiten a usuarios remotos autenticados cambiar el estado de sus imágenes y eludir las restricciones de acceso a través de la cabecera HTTP x-image-meta-status a images/*. A flaw was discovered in the OpenStack Image service (glance) where a tenant could manipulate the status of their images by submitting an HTTP PUT request together with an 'x-image-meta-status' header. A malicious tenant could exploit this flaw to reactivate disabled images, bypass storage quotas, and in some cases replace image contents (where they have owner access). Setups using the Image service's v1 API could allow the illegal modification of image status. • http://rhn.redhat.com/errata/RHSA-2015-1897.html https://bugs.launchpad.net/bugs/1482371 https://security.openstack.org/ossa/OSSA-2015-019.html https://access.redhat.com/security/cve/CVE-2015-5251 https://bugzilla.redhat.com/show_bug.cgi?id=1263511 • CWE-264: Permissions, Privileges, and Access Controls CWE-285: Improper Authorization •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2015-5286 – openstack-glance: Storage overrun by deleting images
https://notcve.org/view.php?id=CVE-2015-5286
OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. OpenStack Image Service (Glance) en versiones anteriores a 2014.2.4 (juno) y 2015.1.x en versiones anteriores a 2015.1.2 (kilo) permite a usuarios remotos autenticados eludir la cuota de almacenamiento y provocar una denegación de servicio (consumo de disco) borrando imágenes que han sido subidas utilizando un token que expira durante el proceso. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2014-9623. A race-condition flaw was discovered in the OpenStack Image service (glance). • http://rhn.redhat.com/errata/RHSA-2015-1897.html http://www.securityfocus.com/bid/76943 https://bugs.launchpad.net/bugs/1498163 https://security.openstack.org/ossa/OSSA-2015-020.html https://access.redhat.com/security/cve/CVE-2015-5286 https://bugzilla.redhat.com/show_bug.cgi?id=1267516 • CWE-264: Permissions, Privileges, and Access Controls CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 1CVE-2014-9684 – openstack-glance: potential resource exhaustion and denial of service using images manipulation API
https://notcve.org/view.php?id=CVE-2014-9684
OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881. OpenStack Image Registry and Delivery Service (Glance) 2014.2 hasta 2014.2.2 no elimina correctamente las imágenes, lo que permite a usuarios remotos autenticados causar una denegación de servicio (consumo de disco) mediante la creación de un número grande de imágenes al utilizar una API v2 de tareas y posteriormente eliminándolas antes de que terminen las subidas, una vulnerabilidad diferente a CVE-2015-1881. Multiple flaws were found in the glance task API that could cause untracked image data to be left in the back end. A malicious user could use these flaws to deliberately accumulate untracked image data, and cause a denial of service via resource exhaustion. • http://lists.openstack.org/pipermail/openstack-announce/2015-February/000336.html http://rhn.redhat.com/errata/RHSA-2015-0938.html http://www.securityfocus.com/bid/72692 https://bugs.launchpad.net/glance/+bug/1371118 https://access.redhat.com/security/cve/CVE-2014-9684 https://bugzilla.redhat.com/show_bug.cgi?id=1194697 • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 1CVE-2015-1881 – openstack-glance: potential resource exhaustion and denial of service using images manipulation API
https://notcve.org/view.php?id=CVE-2015-1881
OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them, a different vulnerability than CVE-2014-9684. OpenStack Image Registry and Delivery Service (Glance) 2014.2 hasta 2014.2.2 no elimina correctamente las imágenes, lo que permite a usuarios remotos autenticados causar una denegación de servicio (consumo de disco) mediante la creación de un número grande de imágenes al utilizar la API v2 de tareas y posteriormente eliminándolas, una vulnerabilidad diferente a CVE-2014-9684. Multiple flaws were found in the glance task API that could cause untracked image data to be left in the back end. A malicious user could use these flaws to deliberately accumulate untracked image data, and cause a denial of service via resource exhaustion. • http://lists.openstack.org/pipermail/openstack-announce/2015-February/000336.html http://rhn.redhat.com/errata/RHSA-2015-0938.html http://www.securityfocus.com/bid/72694 https://bugs.launchpad.net/glance/+bug/1420696 https://access.redhat.com/security/cve/CVE-2015-1881 https://bugzilla.redhat.com/show_bug.cgi?id=1194697 • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •