Description
OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glance | 1:11.0.0-1 | — |
| Debian 13 | glance | 1:11.0.0-1 | — |
| Debian 12 | glance | 1:11.0.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | glance | 1:2014.1.5-0ubuntu1.1 | USN-3446-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 7 | python-glance +2 | 2015.1.1-3.el7ost | RHSA-2015:1897 |
| Red Hat OpenStack 6 | python-glance +2 | 2014.2.3-3.el7ost | RHSA-2015:1897 |
| Red Hat OpenStack 5 | python-glance +2 | 2014.1.5-3.el6ost | RHSA-2015:1897 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 5 | openstack-glance +1 | 2014.2.4.juno-14.1 | SUSE-SU-2016:0101-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | glance | < 2014.2.4 | 2014.2.4 | GHSA-gvjg-r9fv-7qx9 |
| PyPI | glance | >= 2015.1.0, < 2015.1.2 | 2015.1.2 | GHSA-gvjg-r9fv-7qx9 |
| PyPI | glance | < 2014.2.4 · >= 2015.1.0, < 2015.1.2 | 2014.2.4, 2015.1.2 | PYSEC-2026-812 |
Advisories 3
- RHSA-2015:1897 Red Hat Security Advisory: openstack-glance security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- USN-3446-1 glance vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2016:0101-1 Security update for openstack-glance SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://bugs.launchpad.net/bugs/1498163
- 76943 vdb-entry
- https://security.openstack.org/ossa/OSSA-2015-020.html
- RHSA-2015:1897 vendor-advisory