OSSA-2014-012: Remote code execution in Glance Sheepdog backend¶
April 10, 2014
Glance: from 2013.2 to 2013.2.3
Paul McMillan from Nebula reported a vulnerability in Glance Sheepdog backend. By using a specially crafted location, a user allowed to insert or modify Glance image metadata may trigger code execution on the Glance host as the user the Glance service runs under. This may result in Glance host unauthorized access and further compromise of the Glance service. All setups using Glance server with the (enabled by default) sheepdog backend are affected.
Paul McMillan from Nebula (CVE-2014-0162)