CVE-2015-5163
low
CVSS v3
—
CVSS v2
3.5
VIR risk
3.5
Description
The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2015-5163
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | fixed | 2015.1.0-4 |
| debian | bullseye | fixed | 2015.1.0-4 |
| debian | forky | fixed | 2015.1.0-4 |
| debian | sid | fixed | 2015.1.0-4 |
| debian | trixie | fixed | 2015.1.0-4 |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| PyPI | glance | >=2015.1.0,<2015.1.2 | 2015.1.2 |
References
- http://lists.openstack.org/pipermail/openstack-announce/2015-August/000527.html
- http://rhn.redhat.com/errata/RHSA-2015-1639.html
- http://www.securityfocus.com/bid/76346
- https://bugs.launchpad.net/glance/+bug/1471912
- https://nvd.nist.gov/vuln/detail/CVE-2015-5163
- https://github.com/openstack/glance/commit/eb99e45829a1b4c93db5692bdbf636a86faa56c4
- https://access.redhat.com/errata/RHSA-2015:1639
- https://access.redhat.com/security/cve/CVE-2015-5163
- https://bugzilla.redhat.com/show_bug.cgi?id=1252378
- https://github.com/openstack/glance
- https://github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2015-39.yaml
- https://web.archive.org/web/20200228024903/http://www.securityfocus.com/bid/76346
- https://security-tracker.debian.org/tracker/CVE-2015-5163
CWEs
CWE-200
Verify integrity in audit chain (admin only). AS-IS.