CVE-2015-5163

OpenStack Glance is affected by CVE-2015-5163 in the 2015.1.x line prior to 2015.1.2 (kilo). The V2 API allows remote authenticated users to read arbitrary files via a crafted qcow2 backing file during image import. The issue arises from how a backing file is processed and file content is read, e...

CVE-2015-3289

OpenStack Glance prior to 2015.1.1 (kilo) is affected. Affected component: Glance’s image import task flow API. Root cause: remote authenticated users can repeatedly invoke the import task flow API to create images and then delete them, leading to denial of service via disk consumption. Impact: d...