Lucene search

Ubuntu.comUB:CVE-2014-9493

HistoryJan 07, 2015 - 12:00 a.m.

CVE-2014-9493

2015-01-0700:00:00

ubuntu.com

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

0.006

Percentile

78.7%

JSON

The V2 API in OpenStack Image Registry and Delivery Service (Glance) before
2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete
arbitrary files via a full pathname in a file: URL in the image location
property.

Bugs

Notes

Author	Note
jdstrand	Per upstream, “A potential mitigation strategy available for operators is to change the glance policy to restrict access to administrators for get_image_location, set_image_location, and delete_image_location.” Ubuntu 12.04 LTS not affected (does not have V2 API) preliminary packages for Ubuntu 14.04 LTS and 14.10 can be found in: https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+packages
mdeslaur	This issue wasn’t fully addressed by the original patches, see: http://lists.openstack.org/pipermail/openstack-announce/2015-January/000323.html incomplete fix got CVE-2015-1195

Author

Note

jdstrand

Per upstream, “A potential mitigation strategy available for operators is to change the glance policy to restrict access to administrators for get_image_location, set_image_location, and delete_image_location.” Ubuntu 12.04 LTS not affected (does not have V2 API) preliminary packages for Ubuntu 14.04 LTS and 14.10 can be found in: https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+packages

mdeslaur

This issue wasn’t fully addressed by the original patches, see: http://lists.openstack.org/pipermail/openstack-announce/2015-January/000323.html incomplete fix got CVE-2015-1195

OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchglance< 1:2014.1.4-0ubuntu1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	14.04	noarch	glance	< 1:2014.1.4-0ubuntu1	UNKNOWN

References

lists.openstack.org/pipermail/openstack-announce/2015-January/000319.html

launchpad.net/bugs/cve/CVE-2014-9493

nvd.nist.gov/vuln/detail/CVE-2014-9493

security-tracker.debian.org/tracker/CVE-2014-9493

www.cve.org/CVERecord?id=CVE-2014-9493

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

0.006

Percentile

78.7%

JSON

Related for UB:CVE-2014-9493