[Openstack] [OSSA 2014-041.1] Glance v2 API unrestricted path traversal (CVE-2014-9493) ERRATA 1
Grant Murphy
grant.murphy at hp.com
Mon Jan 5 18:23:22 UTC 2015
OpenStack Security Advisory: 2014-041 (ERRATA 1)
CVE: CVE-2014-9493
Date: January 5, 2015
Title: Glance v2 API unrestricted path traversal
Reporter: Masahito Muroi (NTT)
Products: Glance
Versions: up to 2014.1.3 and 2014.2 version up to 2014.2.1
Description:
Masahito Muroi from NTT reported a vulnerability in Glance. By setting
a malicious image location an authenticated user can download or delete
any file on the Glance server for which the Glance process user has
access to. Only setups using the Glance V2 API are affected by this flaw.
Errata:
When the original advisory was published a CVE number was not assigned.
CVE-2014-9493 can now be used to track this vulnerability.
Kilo (development branch) fix:
https://review.openstack.org/141706
Juno fix:
https://review.openstack.org/142373
Icehouse fix:
https://review.openstack.org/142788
Notes:
* This fix was included in the kilo-1 development milestone and will be included
in future 2014.2.2 (juno) and 2014.1.4 (icehouse) releases.
* The OpenStack VMT recommends revoking all credentials stored in files
accessible by Glance as a precautionary measure.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9493
https://launchpad.net/bugs/1400966
OSSA History:
2015-01-05 - Errata 1
2014-12-23 - Original Version
--
Grant Murphy
OpenStack Vulnerability Management Team
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 473 bytes
Desc: not available
URL: <http://lists.openstack.org/pipermail/openstack/attachments/20150105/ee15f6da/attachment.sig>
More information about the Openstack
mailing list