Description
The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cinder | 2:8.0.0-1 | — |
| Debian 14 | glance | 2:12.0.0-1 | — |
| Debian 14 | nova | 2:13.0.0-1 | — |
| Debian 13 | cinder | 2:8.0.0-1 | — |
| Debian 13 | glance | 2:12.0.0-1 | — |
| Debian 13 | nova | 2:13.0.0-1 | — |
| Debian 12 | cinder | 2:8.0.0-1 | — |
| Debian 12 | glance | 2:12.0.0-1 | — |
| Debian 12 | nova | 2:13.0.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | nova | 1:2014.1.5-0ubuntu1.7 | USN-3449-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 9 | python-cinder +2 | 1:8.1.1-4.el7ost | RHSA-2016:2923 |
| Red Hat OpenStack 9 | python-glance +2 | 1:12.0.0-2.el7ost | RHSA-2016:2923 |
| Red Hat OpenStack 8 | python-cinder +1 | 1:7.0.3-1.el7ost | RHSA-2016:2991 |
| Red Hat OpenStack 8 | python-glance +1 | 1:11.0.1-6.el7ost | RHSA-2016:2991 |
| Red Hat OpenStack 8 | python-nova +14 | 1:12.0.5-9.el7ost | RHSA-2016:2991 |
| Red Hat OpenStack 7 | python-cinder +2 | 2015.1.3-12.el7ost | RHSA-2017:0282 |
| Red Hat OpenStack 7 | python-glance +2 | 2015.1.2-3.el7ost | RHSA-2017:0282 |
| Red Hat OpenStack 7 | python-nova +15 | 2015.1.4-32.el7ost | RHSA-2017:0282 |
| Red Hat OpenStack 7 | python-oslo-concurrency +1 | 1.8.2-2.el7ost | RHSA-2017:0282 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 6 | python-cinder +2 | 2014.2.4-11.el7ost | RHSA-2017:0156 |
| Red Hat OpenStack 5 | python-cinder +2 | 2014.1.5-9.el6ost | RHSA-2017:0165, RHSA-2017:0153 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | cinder | < 7.0.2 | 7.0.2 | GHSA-g2j5-7vgx-6xrx |
| PyPI | cinder | >= 8.0.0, < 9.0.0 | 9.0.0 | GHSA-g2j5-7vgx-6xrx |
| PyPI | cinder | < 7.0.2 · >= 8.0.0, < 9.0.0 | 7.0.2, 9.0.0 | PYSEC-2026-2412 |
| PyPI | glance | < 14.0.0 | 14.0.0 | GHSA-g2j5-7vgx-6xrx |
| PyPI | nova | < 12.0.4 | 12.0.4 | GHSA-g2j5-7vgx-6xrx |
Advisories 7
- RHSA-2017:0282 Red Hat Security Advisory: openstack-cinder, openstack-glance, and openstack-nova security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:0165 Red Hat Security Advisory: openstack-cinder security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:0156 Red Hat Security Advisory: openstack-cinder security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:0153 Red Hat Security Advisory: openstack-cinder security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:2991 Red Hat Security Advisory: openstack-cinder, openstack-glance, and openstack-nova update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:2923 Red Hat Security Advisory: openstack-cinder and openstack-glance security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-3449-1 nova vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
References
- https://launchpad.net/bugs/1449062
- 76849 vdb-entry
- RHSA-2017:0153 vendor-advisory
- [oss-security] 20161006 OSSA 2016-012] Malicious qemu-img input may exhaust resources in Cinder, Glance, Nova (CVE-2015-5162) mailing-list
- RHSA-2016:2923 vendor-advisory
- RHSA-2016:2991 vendor-advisory
- RHSA-2017:0165 vendor-advisory
- RHSA-2017:0156 vendor-advisory
- RHSA-2017:0282 vendor-advisory