OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service

MEDIUM 6.8CVE-2015-5286 · GHSA-gvjg-r9fv-7qx9 · PYSEC-2026-812 · Published 26/10/2015 · updated 17/06/2026

Package	Affected versions	Patched versions
glance PyPI	`≥ 2015.1.0, < 2015.1.2< 2014.2.4`	`2015.1.22014.2.4`
image registry and delivery service (glance) openstack	`= 2015.1.0= 2015.1.1≤ 2014.2.3`	No fix yet

Description

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2015-5286 · ADVISORY
access.redhat.com/errata/RHSA-2015:1897 · WEB
access.redhat.com/security/cve/CVE-2015-5286 · WEB
bugs.launchpad.net/bugs/1498163 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
opendev.org/openstack/glance · PACKAGE
rhn.redhat.com/errata/RHSA-2015-1897.html · WEB
security.openstack.org/ossa/OSSA-2015-020.html · WEB
web.archive.org/web/20200228024859/http://www.securityfocus.com/bid/76943 · WEB
rhn.redhat.com/errata/RHSA-2015-1897.html
securityfocus.com/bid/76943
pypi.org/project/glance · PACKAGE
GitHub Advisory GHSA-gvjg-r9fv-7qx9 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free