Arbitrary File Read

2019-01-1509:07:12

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

JSON

openstack-glance is vulnerable to arbitrary file read. A flaw was found in the OpenStack Image Service (glance) import task action. When processing a malicious qcow2 header, glance could be tricked into reading an arbitrary file from the glance host. Only setups using the glance V2 API are affected by this flaw.

CPENameOperatorVersion
openstack-glanceeq16.0.0__0.3.0rc3.el7
openstack-glanceeq16.0.1__1.el7
openstack-glanceeq17.0.0__0.2.0rc2.el7
openstack-glanceeq17.0.0__2.el7
openstack-glanceeq14.0.1__1.el7
openstack-glanceeq2014.1__4.el7ost
openstack-glanceeq2014.1.2__3.el7ost
openstack-glanceeq2014.1.2__1.el7ost
openstack-glanceeq2014.2.3__1.el7ost
openstack-glanceeq2014.2.1__3.el7ost

Name	Operator	Version
openstack-glance	eq	16.0.0__0.3.0rc3.el7
openstack-glance	eq	16.0.1__1.el7
openstack-glance	eq	17.0.0__0.2.0rc2.el7
openstack-glance	eq	17.0.0__2.el7
openstack-glance	eq	14.0.1__1.el7
openstack-glance	eq	2014.1__4.el7ost
openstack-glance	eq	2014.1.2__3.el7ost
openstack-glance	eq	2014.1.2__1.el7ost
openstack-glance	eq	2014.2.3__1.el7ost
openstack-glance	eq	2014.2.1__3.el7ost