CVE-2014-9684
Fixed in a distro release EPSS 2%
OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.
Products: openstack image_registry_and_delivery_service_(glance)
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | glance | 11.0.0a0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openstack 6 | openstack-glance | 0:2014.2.3-1.el7ost |
| Red Hat openstack 6 | openstack-glance-doc | 0:2014.2.3-1.el7ost |
| Red Hat openstack 6 | python-glance | 0:2014.2.3-1.el7ost |
| Red Hat openstack 6 | python-glance-store | 0:0.1.10-3.el7ost |
| SUSE OpenStack Cloud 5 | openstack-ceilometer | 2014.2.4.dev18-9.7 |
| SUSE OpenStack Cloud 5 | openstack-ceilometer-doc | 2014.2.4.dev18-9.11 |
| SUSE OpenStack Cloud 5 | openstack-cinder | 2014.2.4.dev19-9.7 |
| SUSE OpenStack Cloud 5 | openstack-cinder-doc | 2014.2.4.dev19-9.12 |
| SUSE OpenStack Cloud 5 | openstack-glance | 2014.2.4.dev5-9.5 |
| SUSE OpenStack Cloud 5 | openstack-glance-doc | 2014.2.4.dev5-9.7 |
| SUSE OpenStack Cloud 5 | openstack-heat | 2014.2.4.dev13-9.6 |
| SUSE OpenStack Cloud 5 | openstack-heat-doc | 2014.2.4.dev13-9.8 |
| SUSE OpenStack Cloud 5 | openstack-keystone | 2014.2.4.dev5-11.8 |
| SUSE OpenStack Cloud 5 | openstack-keystone-doc | 2014.2.4.dev5-11.12 |
| SUSE OpenStack Cloud 5 | openstack-sahara | 2014.2.4.dev3-9.5 |
| SUSE OpenStack Cloud 5 | openstack-sahara-doc | 2014.2.4.dev3-9.5 |
| SUSE OpenStack Cloud 5 | openstack-suse | 2014.2-9.2 |
| SUSE OpenStack Cloud 5 | python-oslo.i18n | 1.3.1-9.6 |
| SUSE OpenStack Cloud 5 | python-oslo.utils | 1.4.0-14.2 |
| SUSE OpenStack Cloud 5 | python-oslotest | 1.2.0-2.5 |
| SUSE OpenStack Cloud 5 | python-six | 1.9.0-9.2 |