Description
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glance | 2:12.0.0-1 | — |
| Debian 13 | glance | 2:12.0.0-1 | — |
| Debian 12 | glance | 2:12.0.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | glance | 1:2014.1.5-0ubuntu1.1 | USN-3446-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 7 | python-glance +2 | 2015.1.2-2.el7ost | RHSA-2016:0352 |
| Red Hat OpenStack 6 | python-glance +2 | 2014.2.3-4.el7ost | RHSA-2016:0309 |
| Red Hat OpenStack 5 | python-glance +2 | 2014.1.5-5.el6ost | RHSA-2016:0358, RHSA-2016:0354 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | glance | >= 11.0.0, < 11.0.2 | 11.0.2 | GHSA-5xrj-ghhp-hx7p |
Advisories 5
- RHSA-2016:0358 Red Hat Security Advisory: openstack-glance security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2016:0309 Red Hat Security Advisory: openstack-glance security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2016:0352 Red Hat Security Advisory: openstack-glance security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2016:0354 Red Hat Security Advisory: openstack-glance security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- USN-3446-1 glance vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
References
- RHSA-2016:0309 vendor-advisory
- 82696 vdb-entry
- https://security.openstack.org/ossa/OSSA-2016-006.html