OpenStack Glance Signature Verification Bypass

MEDIUM 5.5CVE-2015-8234 · GHSA-wmhw-fvg9-87fc · PYSEC-2017-143 · Published 29/03/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
glance PyPI	`≤ 11.0.0`	No fix yet
glance openstack	`= 11.0.0`	No fix yet

Description

The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted image, which triggers an MD5 collision.

NVD description

The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted image, which triggers an MD5 collision.

References

nvd.nist.gov/vuln/detail/CVE-2015-8234 · ADVISORY
bugs.launchpad.net/glance/+bug/1516031 · WEB
pypa/advisory-database · WEB
seclists.org/oss-sec/2015/q4/303 · WEB
wiki.openstack.org/wiki/OSSN/OSSN-0061 · WEB
seclists.org/oss-sec/2015/q4/303 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free