OpenStack Glance v2 API unrestricted path traversal through filesystem:// scheme

MOYENNE 6.5CVE-2015-1195 · GHSA-pwrj-f53c-f89j · PYSEC-2026-815 · Published 21/01/2015 · updated 17/06/2026

En bref

CVE-2015-1195 est une vulnérabilité MOYENNE (CVSS 6.5) touchant glance, image registry and delivery service (glance) (openstack).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.8%, plus élevée que 86.4% des vulnérabilités.
Correctif : mettre à jour vers 11.0.0a0, 2014.1.4, 2014.2.2 ou plus récent.

Package	Affected versions	Patched versions
glance PyPI	`< 11.0.0a0`	`11.0.0a0`
image registry and delivery service (glance) openstack	`≥ 2014.1, < 2014.1.4≥ 2014.2, < 2014.2.2`	`2014.1.42014.2.2`

Description

The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem:// URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.

NVD description

The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.

References

nvd.nist.gov/vuln/detail/CVE-2015-1195 · ADVISORY
openstack/glance commit 5191ed1 · WEB
openstack/glance commit 7d3a1db · WEB
openstack/glance commit a2d986b · WEB
bugs.launchpad.net/ossa/+bug/1408663 · WEB
openstack/glance · PACKAGE
lists.openstack.org/pipermail/openstack-announce/2015-January/000325.html · WEB
secunia.com/advisories/62169 · WEB
openwall.com/lists/oss-security/2015/01/15/2 · WEB
openwall.com/lists/oss-security/2015/01/18/5 · WEB
oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html · WEB

Autres vulnérabilités de glance

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

En bref

CVE-2015-1195 est une vulnérabilité MOYENNE (CVSS 6.5) touchant glance, image registry and delivery service (glance) (openstack).

Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.8%, plus élevée que 86.4% des vulnérabilités.

Correctif : mettre à jour vers 11.0.0a0, 2014.1.4, 2014.2.2 ou plus récent.

Package

Affected versions

Patched versions

glance

PyPI

< 11.0.0a0

11.0.0a0

image registry and delivery service (glance)

openstack

≥ 2014.1, < 2014.1.4≥ 2014.2, < 2014.2.2

2014.1.42014.2.2

Description

NVD description

The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.

Autres vulnérabilités de glance

Tout voir →