CVE-2014-5356

2014-08-2514:55:00

CWE-264

[email protected]

web.nvd.nist.gov

cve-2014-5356

openstack

glance

image registry

dos

vulnerability

nvd

6 Medium

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

0.007 Low

EPSS

Percentile

80.0%

JSON

OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.

CPENameOperatorVersion
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service \(glance\)eqjuno-1
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service \(glance\)le2013.2.3
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service \(glance\)eq2014.1.2
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service \(glance\)eq2013.2
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service \(glance\)eq2013.2.1
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service \(glance\)eq2013.2.2
canonical:ubuntu_linuxcanonical ubuntu linuxeq14.04
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service \(glance\)eq2014.1.1
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service \(glance\)eqjuno-2
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service \(glance\)eq2014.1

CPE	Name	Operator	Version
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service \(glance\)	eq	juno-1
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service \(glance\)	le	2013.2.3
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service \(glance\)	eq	2014.1.2
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service \(glance\)	eq	2013.2
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service \(glance\)	eq	2013.2.1
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service \(glance\)	eq	2013.2.2
canonical:ubuntu_linux	canonical ubuntu linux	eq	14.04
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service \(glance\)	eq	2014.1.1
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service \(glance\)	eq	juno-2
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service \(glance\)	eq	2014.1