Description
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete arbitrary files via a full pathname in a file: URL in the image location property.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glance | 2014.1.3-6 | — |
| Debian 13 | glance | 2014.1.3-6 | — |
| Debian 12 | glance | 2014.1.3-6 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 5 | python-glance +2 | 2014.1.3-4.el6ost | RHSA-2015:0246 |
| Red Hat OpenStack 4 | python-glance +2 | 2013.2.4-3.el6ost | RHSA-2015:0246 |
Advisories 1
- RHSA-2015:0246 Red Hat Security Advisory: openstack-glance security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
References
- RHSA-2015:0246 vendor-advisory
- https://bugs.launchpad.net/glance/+bug/1400966
- https://security.openstack.org/ossa/OSSA-2014-041.html
- 71688 vdb-entry
- [openstack-announce] 20141223 [OSSA-2014-041] Glance v2 API unrestricted path traversal mailing-list
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html