Description
OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them, a different vulnerability than CVE-2014-9684.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 6 | python-glance +2 | 2014.2.3-1.el7ost | RHSA-2015:0938 |
| Red Hat OpenStack 6 | python-glance-store | 0.1.10-3.el7ost | RHSA-2015:0938 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | glance | < 11.0.0a0 | 11.0.0a0 | GHSA-4jp4-3c62-r8jv |
Advisories 1
- RHSA-2015:0938 Red Hat Security Advisory: openstack-glance security and bug fix update Red Hat Security Advisories (RHSA) · Oct 8, 2026