OpenStack Glance Bypass the storage quota and Denial of service

MEDIUM 4.0CVE-2014-9623 · GHSA-j4mh-9wq6-8rg6 · PYSEC-2026-813 · Published 23/01/2015 · updated 17/06/2026

Package	Affected versions	Patched versions
glance PyPI	`< 11.0.0a0`	`11.0.0a0`
image registry and delivery service (glance) openstack	`= 2014.2≤ 2014.1.3`	No fix yet
openstack redhat	`= 5.0`	No fix yet

Description

OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting an image in the saving state.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2014-9623 · ADVISORY
openstack/glance commit 0dc8fbb · WEB
openstack/glance commit 7d5d865 · WEB
openstack/glance commit f1260cc · WEB
bugs.launchpad.net/glance/+bug/1383973 · WEB
bugs.launchpad.net/glance/+bug/1398830 · WEB
openstack/glance · PACKAGE
security.openstack.org/ossa/OSSA-2015-003.html · WEB
rhn.redhat.com/errata/RHSA-2015-0644.html · WEB
rhn.redhat.com/errata/RHSA-2015-0837.html · WEB
rhn.redhat.com/errata/RHSA-2015-0838.html · WEB
secunia.com/advisories/62165 · WEB
openwall.com/lists/oss-security/2015/01/18/4 · WEB
oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html · WEB
pypi.org/project/glance · PACKAGE
GitHub Advisory GHSA-j4mh-9wq6-8rg6 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free