CVE-2015-5163

Advisory

The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.


MLIST:[openstack-announce] 20150813 [OSSA 2015-014] Glance v2 API host file disclosure through qcow2 backing file (CVE-2015-5163): http://lists.openstack.org/pipermail/openstack-announce/2015-August/000527.html
CONFIRM:https://bugs.launchpad.net/glance/+bug/1471912: https://bugs.launchpad.net/glance/+bug/1471912
REDHAT:RHSA-2015:1639: http://rhn.redhat.com/errata/RHSA-2015-1639.html
BID:76346: http://www.securityfocus.com/bid/76346

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5163
• http://lists.openstack.org/pipermail/openstack-announce/2015-August/000527.html
• http://rhn.redhat.com/errata/RHSA-2015-1639.html
• https://bugs.launchpad.net/glance/+bug/1471912
• http://www.securityfocus.com/bid/76346