Description
A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the disclosure of the operator's backend credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | OpenStack Folsom for RHEL 6 | — | — |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | — |
| Red Hat | Red Hat OpenStack Platform 17.1 | — | — |
| Red Hat | Red Hat OpenStack Platform 18.0 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glance | 2012.1.1-5 | — |
| Debian 13 | glance | 2012.1.1-5 | — |
| Debian 12 | glance | 2012.1.1-5 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 2 | python-glance +2 | 2012.2.3-8.el6ost | RHSA-2013:0707 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | glance | < 11.0.0a0 | 11.0.0a0 | GHSA-c8w9-83vg-r8vv |
| PyPI | glance | <= v1 | — | PYSEC-2013-46 |
Advisories 1
- RHSA-2013:0707 Red Hat Security Advisory: openstack-glance security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- http://osvdb.org/91304
- http://rhn.redhat.com/errata/RHSA-2013-0707.html
- http://secunia.com/advisories/52565
- http://www.openwall.com/lists/oss-security/2013/03/14/15
- http://www.securityfocus.com/bid/58490
- http://www.ubuntu.com/usn/USN-1764-1
- RHSA-2013:0707 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2013-1840 vdb-entry
- https://bugs.launchpad.net/glance/+bug/1135541
- https://exchange.xforce.ibmcloud.com/vulnerabilities/82878
- https://review.openstack.org/#/c/24437/
- https://review.openstack.org/#/c/24438/
- https://review.openstack.org/#/c/24439/