Description
OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 6 | python-glance +2 | 2014.2.3-1.el7ost | RHSA-2015:0938 |
| Red Hat OpenStack 6 | python-glance-store | 0.1.10-3.el7ost | RHSA-2015:0938 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 5 | openstack-ceilometer | 2014.2.4.dev18-9.7 | SUSE-SU-2015:1515-1 |
| SUSE OpenStack Cloud 5 | openstack-ceilometer-doc | 2014.2.4.dev18-9.11 | SUSE-SU-2015:1515-1 |
| SUSE OpenStack Cloud 5 | openstack-cinder | 2014.2.4.dev19-9.7 | SUSE-SU-2015:1515-1 |
| SUSE OpenStack Cloud 5 | openstack-cinder-doc | 2014.2.4.dev19-9.12 | SUSE-SU-2015:1515-1 |
| SUSE OpenStack Cloud 5 | openstack-glance | 2014.2.4.dev5-9.5 | SUSE-SU-2015:1515-1 |
| SUSE OpenStack Cloud 5 | openstack-glance-doc | 2014.2.4.dev5-9.7 | SUSE-SU-2015:1515-1 |
| SUSE OpenStack Cloud 5 | openstack-heat | 2014.2.4.dev13-9.6 | SUSE-SU-2015:1515-1 |
| SUSE OpenStack Cloud 5 | openstack-heat-doc | 2014.2.4.dev13-9.8 | SUSE-SU-2015:1515-1 |
| SUSE OpenStack Cloud 5 | openstack-keystone | 2014.2.4.dev5-11.8 | SUSE-SU-2015:1515-1 |
| SUSE OpenStack Cloud 5 | openstack-keystone-doc | 2014.2.4.dev5-11.12 | SUSE-SU-2015:1515-1 |
| SUSE OpenStack Cloud 5 | openstack-sahara +1 | 2014.2.4.dev3-9.5 | SUSE-SU-2015:1515-1 |
| SUSE OpenStack Cloud 5 | openstack-suse | 2014.2-9.2 | SUSE-SU-2015:1515-1 |
| SUSE OpenStack Cloud 5 | python-oslo.i18n | 1.3.1-9.6 | SUSE-SU-2015:1515-1 |
| SUSE OpenStack Cloud 5 | python-oslo.utils | 1.4.0-14.2 | SUSE-SU-2015:1515-1 |
| SUSE OpenStack Cloud 5 | python-oslotest | 1.2.0-2.5 | SUSE-SU-2015:1515-1 |
| SUSE OpenStack Cloud 5 | python-six | 1.9.0-9.2 | SUSE-SU-2015:1515-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | glance | < 11.0.0a0 | 11.0.0a0 | GHSA-h737-q6g6-8wr6 |
Advisories 2
- RHSA-2015:0938 Red Hat Security Advisory: openstack-glance security and bug fix update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- SUSE-SU-2015:1515-1 Security update for openstack and python-oslo.utils SUSE / openSUSE Security Updates · Feb 4, 2026