OpenStack Glance is vulnerable to Exposure of Sensitive Information

LOW 3.5CVE-2013-1840 · GHSA-c8w9-83vg-r8vv · PYSEC-2013-46 · Published 22/03/2013 · updated 16/06/2026

Package	Affected versions	Patched versions
glance PyPI	`≤ v1< 11.0.0a0`	`11.0.0a0`
glance openstack	`= v1`	No fix yet

Description

The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2013-1840 · ADVISORY
openstack/glance commit 74b067d · WEB
openstack/glance commit dd849a9 · WEB
openstack/glance commit e75764e · WEB
bugs.launchpad.net/glance/+bug/1135541 · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/82878 · WEB
openstack/glance · PACKAGE
pypa/advisory-database · WEB
review.openstack.org · WEB
review.openstack.org · WEB
review.openstack.org · WEB
osvdb.org/91304 · WEB
rhn.redhat.com/errata/RHSA-2013-0707.html · WEB
secunia.com/advisories/52565 · WEB
openwall.com/lists/oss-security/2013/03/14/15 · WEB
securityfocus.com/bid/58490 · WEB
ubuntu.com/usn/USN-1764-1 · WEB
review.openstack.org
review.openstack.org
review.openstack.org
GitHub Advisory GHSA-c8w9-83vg-r8vv · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free