CVE-2015-5251: OpenStack Image Service (Glance) allows… – CVSS 5.5 · Watchpost

← All vulnerabilities

OpenStack Image Service (Glance) allows remote authenticated users to bypass access restrictions

中危 5.5CVE-2015-5251 · GHSA-q748-mcwg-xmqv · PYSEC-2026-816 · Published 26/10/2015 · updated 17/06/2026

要点

CVE-2015-5251 是影响 glance, image registry and delivery service (glance) (openstack) 的中危 (CVSS 5.5)漏洞。
未来 30 天内被利用的概率（EPSS）：2.1%，高于 81.3% 的漏洞。
修复：升级到 2014.2.4, 2015.1.2 或更高版本。

Package	Affected versions	Patched versions
glance PyPI	`≥ 2011.2, < 2014.2.4≥ 2015.1.0, < 2015.1.2`	`2014.2.42015.1.2`
image registry and delivery service (glance) openstack	`= 2015.1.0= 2015.1.1≤ 2014.2.3`	No fix yet

Description

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

NVD description

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

References

nvd.nist.gov/vuln/detail/CVE-2015-5251 · ADVISORY
access.redhat.com/errata/RHSA-2015:1897 · WEB
access.redhat.com/security/cve/CVE-2015-5251 · WEB
bugs.launchpad.net/bugs/1482371 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
opendev.org/openstack/glance · PACKAGE
rhn.redhat.com/errata/RHSA-2015-1897.html · WEB
security.openstack.org/ossa/OSSA-2015-019.html · WEB
rhn.redhat.com/errata/RHSA-2015-1897.html
pypi.org/project/glance · PACKAGE
GitHub Advisory GHSA-q748-mcwg-xmqv · ADVISORY

glance 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free