OpenStack Image Service (Glance) allows remote authenticated users to read arbitrary file

BASSO 3.5CVE-2015-5163 · GHSA-q73f-vjc2-3gqf · PYSEC-2015-39 · Published 19/08/2015 · updated 17/06/2026

Package	Affected versions	Patched versions
glance PyPI	`≥ 2015.1.0, < 2015.1.2`	`2015.1.2`
glance openstack	`= 2015.1.0= 2015.1.1`	No fix yet

Description

The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2015-5163 · ADVISORY
openstack/glance commit eb99e45 · WEB
access.redhat.com/errata/RHSA-2015:1639 · WEB
access.redhat.com/security/cve/CVE-2015-5163 · WEB
bugs.launchpad.net/glance/+bug/1471912 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
openstack/glance · PACKAGE
pypa/advisory-database · WEB
web.archive.org/web/20200228024903/http://www.securityfocus.com/bid/76346 · WEB
lists.openstack.org/pipermail/openstack-announce/2015-August/000527.html · WEB
rhn.redhat.com/errata/RHSA-2015-1639.html · WEB
securityfocus.com/bid/76346

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free