Description
The v1 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protected images via an image deletion request, a different vulnerability than CVE-2012-5482.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glance | 2012.1.1-2 | — |
| Debian 13 | glance | 2012.1.1-2 | — |
| Debian 12 | glance | 2012.1.1-2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 1 | python-glance +2 | 2012.1.2-2.el6 | RHSA-2012:1558 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | glance | < 11.0.0a0 | 11.0.0a0 | GHSA-6rrm-xxvh-7r87 |
Advisories 1
- RHSA-2012:1558 Red Hat Security Advisory: openstack-glance security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
References
- 51174 third-party-advisory
- 51234 third-party-advisory
- USN-1626-1 vendor-advisory
- RHSA-2012:1558 vendor-advisory
- 56437 vdb-entry
- https://github.com/openstack/glance/commit/90bcdc5a89e350a358cf320a03f5afe99795f6f6
- FEDORA-2012-17901 vendor-advisory
- [oss-security] 20121107 [OSSA 2012-017] Authentication bypass for image deletion (CVE-2012-4573) mailing-list
- [oss-security] 20121109 [OSSA 2012-017.1] Authentication bypass for image deletion (CVE-2012-4573, CVE-2012-5482) ERRATA 1 mailing-list
- http://packetstormsecurity.com/files/118733/Red-Hat-Security-Advisory-2012-1558-01.html
- 87248 vdb-entry
- https://github.com/openstack/glance/commit/6ab0992e5472ae3f9bef0d2ced41030655d9d2bc
- USN-1626-2 vendor-advisory
- https://bugs.launchpad.net/glance/+bug/1065187
- SUSE-SU-2012:1455 vendor-advisory
- https://github.com/openstack/glance/commit/efd7e75b1f419a52c7103c7840e24af8e5deb29d
- openstack-glance-sec-bypass(79895) vdb-entry