Design/Logic Flaw

2014-08-2514:55:00

PRIOn knowledge base

www.prio-n.com

6.6 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

0.008 Low

EPSS

Percentile

81.0%

JSON

OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.

CPENameOperatorVersion
ubuntu_linuxeq14.04
image_registry_and_delivery_service_\\(glance\\)eqjuno-1
image_registry_and_delivery_service_\\(glance\\)le2013.2.3
image_registry_and_delivery_service_\\(glance\\)eq2014.1.2
image_registry_and_delivery_service_\\(glance\\)eq2013.2
image_registry_and_delivery_service_\\(glance\\)eq2013.2.1
image_registry_and_delivery_service_\\(glance\\)eq2013.2.2
image_registry_and_delivery_service_\\(glance\\)eq2014.1.1
image_registry_and_delivery_service_\\(glance\\)eqjuno-2
image_registry_and_delivery_service_\\(glance\\)eq2014.1

Name	Operator	Version
ubuntu_linux	eq	14.04
image_registry_and_delivery_service_\\(glance\\)	eq	juno-1
image_registry_and_delivery_service_\\(glance\\)	le	2013.2.3
image_registry_and_delivery_service_\\(glance\\)	eq	2014.1.2
image_registry_and_delivery_service_\\(glance\\)	eq	2013.2
image_registry_and_delivery_service_\\(glance\\)	eq	2013.2.1
image_registry_and_delivery_service_\\(glance\\)	eq	2013.2.2
image_registry_and_delivery_service_\\(glance\\)	eq	2014.1.1
image_registry_and_delivery_service_\\(glance\\)	eq	juno-2
image_registry_and_delivery_service_\\(glance\\)	eq	2014.1