OpenStack Glance is vulnerable to Exposure of Sensitive Information

보통 6.5CVE-2013-1840 · GHSA-c8w9-83vg-r8vv · PYSEC-2013-46 · Published 22/03/2013 · updated 30/10/2026

Package	Affected versions	Patched versions
glance PyPI	`≤ v1< 11.0.0a0`	`11.0.0a0`
glance openstack	`= v1`	No fix yet

Description

The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image.

NVD description

A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the disclosure of the operator's backend credentials.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free