CVE-2014-5356
Fixed in a distro release EPSS 2%
OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.
Products: openstack image_registry_and_delivery_service_(glance), canonical ubuntu_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | glance | 11.0.0a0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | glance | 2014.1.3-1 |
| Debian 13 | glance | 2014.1.3-1 |
| Red Hat openstack 4 | openstack-glance | 0:2013.2.4-1.el6ost |
| Red Hat openstack 4 | openstack-glance-doc | 0:2013.2.4-1.el6ost |
| Red Hat openstack 4 | python-glance | 0:2013.2.4-1.el6ost |
| Red Hat openstack 5 | openstack-glance | 0:2014.1.2-3.el7ost |
| Red Hat openstack 5 | openstack-glance | 0:2014.1.2-5.el6ost |
| Red Hat openstack 5 | openstack-glance-doc | 0:2014.1.2-3.el7ost |
| Red Hat openstack 5 | openstack-glance-doc | 0:2014.1.2-5.el6ost |
| Red Hat openstack 5 | python-glance | 0:2014.1.2-3.el7ost |
| Red Hat openstack 5 | python-glance | 0:2014.1.2-5.el6ost |
| Ubuntu 14.04 LTS | glance | 1:2014.1.2-0ubuntu1.1 |