OSSA-2014-041: Glance v2 API unrestricted path traversal

Date:

December 23, 2014

CVE:

CVE-2014-9493

Affects

• Glance: up to 2014.1.3 and 2014.2 version up to 2014.2.1

Description

Masahito Muroi from NTT reported a vulnerability in Glance. By setting a malicious image location an authenticated user can download or delete any file on the Glance server for which the Glance process user has access to. Only setups using the Glance V2 API are affected by this flaw.

Errata

When the original advisory was published a CVE number was not assigned. CVE-2014-9493 can now be used to track this vulnerability.

Patches

• https://review.openstack.org/142788 (Icehouse)

• https://review.openstack.org/142373 (Juno)

• https://review.openstack.org/141706 (Kilo)

Credits

• Masahito Muroi from NTT (CVE-2014-9493)

References

• https://launchpad.net/bugs/1400966

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9493

Notes

• This fix was included in the kilo-1 development milestone and will be included in future 2014.2.2 (juno) and 2014.1.4 (icehouse) releases.

• The OpenStack VMT recommends revoking all credentials stored in files accessible by Glance as a precautionary measure.

OSSA History

• 2015-01-05 - Errata 1

• 2014-12-23 - Original Version