oss-sec mailing list archives
[grant.murphy () hp com: [oss-security] CVE request for vulnerability in OpenStack Glance]
From: Grant Murphy <grant.murphy () hp com>
Date: Mon, 22 Dec 2014 07:20:59 -0800
Just wondering if this has been missed? All changes have been merged and we are just waiting on a CVE id. The OpenStack VMT consider this to be a critical issue. - Grant ----- Forwarded message from "Murphy, Grant Charles" <grant.murphy () hp com> -----
Date: Mon, 15 Dec 2014 18:00:53 +0000 From: "Murphy, Grant Charles" <grant.murphy () hp com> To: "oss-security () lists openwall com" <oss-security () lists openwall com> Subject: [oss-security] CVE request for vulnerability in OpenStack Glance -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 A vulnerability was discovered in OpenStack (see below). In order to ensure full traceability, we need a CVE number assigned that we can attach to further notifications. This issue is already public, although an advisory was not sent yet. Title: Glance v2 API unrestricted path traversal Reporter: Masahito Muroi (NTT) Products: Glance Versions: up to 2014.1.3 and 2014.2 version up to 2014.2.1 Description: Masahito Muroi from NTT reported a vulnerability in Glance. By setting a malicious image location an authenticated user can download or delete any file on the Glance server for which the Glance process user has access to. Only setups using the Glance V2 API are affected by this flaw. References: https://launchpad.net/bugs/1400966 Thanks in advance, Grant Murphy OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJUjyEvAAoJEJ3kO55VGiJS2ZwH/RmVDlq6ZycvDB+TRicOf1Ho kam2t/cc/4fvaZN1BYTrcjaPn+HK9ETdNdh3cHwiC6UYgtEa7Gb3IiboY4fK/7Si hrVdgdOWRB+I3dkGrHb+kAaWNGSKJoHahq3mQ5NuXg+oFjR42caslX3vn2f8tBnA Ybgqvelu5S1ht5x4XBoagmb0gSafp6a4xik4cwf0FkbkqCnO/EE5beHVSYXu4aVG VLGtgd3+l6EjvMoSKXkWKAGwMC1fLCV+ISr1e4CBng5EGSqFmiTYZghQ0e5mvO2q 4QgEqAgUl1DwpRJYyNeS3dHILA32Nuu0NEKvGn61AdXzxfMZpok1GwLPTq+DWyk= =meRY -----END PGP SIGNATURE-----
----- End forwarded message -----
Attachment:
_bin
Description:
Current thread:
- [grant.murphy () hp com: [oss-security] CVE request for vulnerability in OpenStack Glance] Grant Murphy (Dec 22)