OpenStack Image Service (Glance) allows remote authenticated users to bypass access restrictions

MEDIUM 5.5CVE-2015-5251 · GHSA-q748-mcwg-xmqv · PYSEC-2026-816 · Published 26/10/2015 · updated 17/06/2026

Package	Affected versions	Patched versions
glance PyPI	`≥ 2011.2, < 2014.2.4≥ 2015.1.0, < 2015.1.2`	`2014.2.42015.1.2`
image registry and delivery service (glance) openstack	`= 2015.1.0= 2015.1.1≤ 2014.2.3`	No fix yet

Description

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2015-5251 · ADVISORY
access.redhat.com/errata/RHSA-2015:1897 · WEB
access.redhat.com/security/cve/CVE-2015-5251 · WEB
bugs.launchpad.net/bugs/1482371 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
opendev.org/openstack/glance · PACKAGE
rhn.redhat.com/errata/RHSA-2015-1897.html · WEB
security.openstack.org/ossa/OSSA-2015-019.html · WEB
rhn.redhat.com/errata/RHSA-2015-1897.html
pypi.org/project/glance · PACKAGE
GitHub Advisory GHSA-q748-mcwg-xmqv · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free