Summary
It was discovered that OpenStack Glance was incorrectly validating the IP
addresses and the redirect destination URL when downloading or importing
images from a remote source. An attacker could possibly use this issue to
perform server-side request forgery and obtain sensitive information.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | glance | 2:24.2.1-0ubuntu1.4 |
| Ubuntu · 24.04 LTS 24.04:LTS | glance | 2:28.1.0-0ubuntu1.2 |
| Ubuntu · 25.10 | glance | 2:31.0.0-0ubuntu1.2 |
References
-
report
https://bugs.launchpad.net/glance/+bug/2138602