Summary
Martin Kaesberger discovered that OpenStack Glance's image processing could
return the contents of arbitrary files. An attacker could possibly use this
issue to exfiltrate sensitive data. This issue only affected Ubuntu 16.04
LTS and Ubuntu 18.04 LTS. (CVE-2024-32498)
Hyeongeun Ji and Abhishek Kekane discovered several server-side request
forgery vulnerabilities in OpenStack Glance's image import. An attacker
could possibly use this issue to bypass URL validation checks and redirect
to internal services. This issue only affected Ubuntu 18.04 LTS and Ubuntu
20.04 LTS. (CVE-2026-34881)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | glance | 2:12.0.0-0ubuntu2+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | glance | 2:16.0.1-0ubuntu1.1+esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | glance | 2:20.2.0-0ubuntu1.2+esm2 |