Description
OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and Havana before 2013.2, when the download_image policy is configured, does not properly restrict access to cached images, which allows remote authenticated users to read otherwise restricted images via an image UUID.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glance | 2013.2-1 | — |
| Debian 13 | glance | 2013.2-1 | — |
| Debian 12 | glance | 2013.2-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 3 | python-glance +2 | 2013.1.4-1.el6ost | RHSA-2013:1525 |
Advisories 1
- RHSA-2013:1525 Red Hat Security Advisory: openstack-glance security and bug fix update Red Hat Security Advisories (RHSA) · Aug 1, 2026
References
- RHSA-2013:1525 vendor-advisory
- USN-2003-1 vendor-advisory
- https://launchpad.net/glance/+milestone/2013.1.4
- https://bugs.launchpad.net/glance/+bug/1235378
- [oss-security] 20131015 CVE request for a vulnerability in OpenStack Glance mailing-list
- 63159 vdb-entry
- [oss-security] 20131015 Re: CVE request for a vulnerability in OpenStack Glance mailing-list
- https://bugs.launchpad.net/glance/+bug/1235226
- https://launchpad.net/glance/+milestone/2013.2