—

PYSEC-2013-46

Details

The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI / glance

Introduced in: 0

No fixed version published yet for glance (pip). Pin to a known-safe version or switch to an alternative.

References

http://osvdb.org/91304 [WEB]
http://www.openwall.com/lists/oss-security/2013/03/14/15 [WEB]
http://www.securityfocus.com/bid/58490 [WEB]
https://bugs.launchpad.net/glance/+bug/1135541 [WEB]
https://exchange.xforce.ibmcloud.com/vulnerabilities/82878 [WEB]
https://review.openstack.org/#/c/24437/ [WEB]
https://review.openstack.org/#/c/24438/ [WEB]
https://review.openstack.org/#/c/24439/ [WEB]
http://rhn.redhat.com/errata/RHSA-2013-0707.html [ADVISORY]
http://secunia.com/advisories/52565 [ADVISORY]
http://www.ubuntu.com/usn/USN-1764-1 [ADVISORY]