CVE-2014-9493

MEDIUM 5.5CVE-2014-9493 · Published 07/01/2015 · updated 17/06/2026

In short

CVE-2014-9493 is a MEDIUM (CVSS 5.5) vulnerability affecting image registry and delivery service (glance) (openstack), openstack (redhat).
Chance of exploitation in the next 30 days (EPSS): 2.8%, higher than 86.4% of all vulnerabilities.
Fix: update to 2014.1.4, 2014.2.2 or later.

Package	Affected versions	Patched versions
image registry and delivery service (glance) openstack	`≥ 2014.1, < 2014.1.4≥ 2014.2, < 2014.2.2`	`2014.1.42014.2.2`
openstack redhat	`= 4.0= 5.0`	No fix yet

Description

The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete arbitrary files via a full pathname in a file: URL in the image location property.

References

lists.openstack.org/pipermail/openstack-announce/2014-December/000317.html · Patch
rhn.redhat.com/errata/RHSA-2015-0246.html · Third Party Advisory
oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html · Third Party Advisory
securityfocus.com/bid/71688 · Third Party Advisory
bugs.launchpad.net/glance/+bug/1400966 · Issue Tracking
security.openstack.org/ossa/OSSA-2014-041.html · Vendor Advisory

More vulnerabilities in image registry and delivery service (glance)

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

image registry and delivery service (glance)

openstack

≥ 2014.1, < 2014.1.4≥ 2014.2, < 2014.2.2

2014.1.42014.2.2

openstack

redhat

= 4.0= 5.0

No fix yet

More vulnerabilities in image registry and delivery service (glance)

See all →