CVE-2014-9493
Fixed in a distro release EPSS 3%
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete arbitrary files via a full pathname in a file: URL in the image location property.
Products: redhat openstack, openstack image_registry_and_delivery_service_(glance)
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | glance | 2014.1.3-6 |
| Debian 13 | glance | 2014.1.3-6 |
| Red Hat openstack 4 | openstack-glance | 0:2013.2.4-3.el6ost |
| Red Hat openstack 4 | openstack-glance-doc | 0:2013.2.4-3.el6ost |
| Red Hat openstack 4 | python-glance | 0:2013.2.4-3.el6ost |
| Red Hat openstack 5 | openstack-glance | 0:2014.1.3-4.el6ost |
| Red Hat openstack 5 | openstack-glance | 0:2014.1.3-4.el7ost |
| Red Hat openstack 5 | openstack-glance-doc | 0:2014.1.3-4.el6ost |
| Red Hat openstack 5 | openstack-glance-doc | 0:2014.1.3-4.el7ost |
| Red Hat openstack 5 | python-glance | 0:2014.1.3-4.el6ost |
| Red Hat openstack 5 | python-glance | 0:2014.1.3-4.el7ost |