Description
A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 `/images` API POST method for authenticated users, resulting in possible denial of service attacks through database table saturation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Openstack Foundation | openstack-glance | v1 and v2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glance | No fix yet | — |
| Debian 13 | glance | No fix yet | — |
| Debian 12 | glance | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | glance | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 8 | crowbar | 5.0+git.1528696845.81a7b5d0-3.3.1 | SUSE-SU-2018:2762-1 |
| SUSE OpenStack Cloud Crowbar 8 | crowbar-core | 5.0+git.1533887407.6e9b0412d-3.8.2 | SUSE-SU-2018:2762-1 |
| SUSE OpenStack Cloud Crowbar 8 | crowbar-ha | 5.0+git.1530177874.35b9099-3.3.1 | SUSE-SU-2018:2762-1, SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud Crowbar 8 | crowbar-init | 5.0+git.1520420379.d5bbb35-3.3.1 | SUSE-SU-2018:2762-1 |
| SUSE OpenStack Cloud Crowbar 8 | crowbar-openstack | 5.0+git.1534167599.d325ef804-4.8.2 | SUSE-SU-2018:2762-1, SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud Crowbar 8 | crowbar-ui | 1.2.0+git.1533844061.4ac8e723-3.3.1 | SUSE-SU-2018:2762-1 |
| SUSE OpenStack Cloud Crowbar 8 | kibana | 4.6.3-3.6.1 | SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron +1 | 11.0.9~dev69-3.40.1 | SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-nova +1 | 16.1.9~dev78-3.45.1 | SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-Django | 1.11.29-3.22.1 | SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud Crowbar 8 | release-notes-suse-openstack-cloud | 8.20201214-3.29.1 | SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud Crowbar 8 | sleshammer | 0.8.0-0.20.2 | SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud Crowbar 8 | spark | 1.6.3-8.6.1 | SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud 8 | ardana-ansible | 8.0+git.1539739656.0ef51c9-3.46.1 | SUSE-RU-2018:3638-1 |
| SUSE OpenStack Cloud 8 | ardana-barbican | 8.0+git.1534266594.8136db7-4.27.2 | SUSE-RU-2018:3638-1 |
| SUSE OpenStack Cloud 8 | ardana-cinder | 8.0+git.1535412193.d9ad231-3.27.2 | SUSE-RU-2018:3638-1 |
| SUSE OpenStack Cloud 8 | ardana-cluster | 8.0+git.1534266734.ec4822f-3.30.2 | SUSE-RU-2018:3638-1 |
| SUSE OpenStack Cloud 8 | ardana-cobbler | 8.0+git.1534780521.780753b-3.29.2 | SUSE-RU-2018:3638-1 |
| SUSE OpenStack Cloud 8 | ardana-freezer | 8.0+git.1534266805.c9ea29b-3.12.2 | SUSE-RU-2018:3638-1 |
| SUSE OpenStack Cloud 8 | ardana-glance | 8.0+git.1537790499.b15fdea-3.8.2 | SUSE-RU-2018:3638-1 |
| SUSE OpenStack Cloud 8 | ardana-horizon | 8.0+git.1610733160.0f577f4-3.21.1 | SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud 8 | ardana-input-model | 8.0+git.1539086744.5ae1d6f-3.21.2 | SUSE-RU-2018:3638-1 |
| SUSE OpenStack Cloud 8 | ardana-keystone | 8.0+git.1536100286.ddd8d3e-3.15.2 | SUSE-RU-2018:3638-1 |
| SUSE OpenStack Cloud 8 | ardana-logging | 8.0+git.1610573640.452aed1-3.27.1 | SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud 8 | ardana-monasca | 8.0+git.1610740501.5dca121-3.27.1 | SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud 8 | ardana-mq | 8.0+git.1534267034.f95e1ec-3.5.2 | SUSE-RU-2021:0351-1, SUSE-RU-2018:3638-1 |
| SUSE OpenStack Cloud 8 | ardana-neutron | 8.0+git.1537805998.7898f24-3.21.2 | SUSE-RU-2018:3638-1 |
| SUSE OpenStack Cloud 8 | ardana-nova | 8.0+git.1537895345.35a03a2-3.14.2 | SUSE-RU-2018:3638-1 |
| SUSE OpenStack Cloud 8 | ardana-octavia | 8.0+git.1534267086.b7dbe77-3.8.2 | SUSE-RU-2018:3638-1 |
| SUSE OpenStack Cloud 8 | ardana-osconfig | 8.0+git.1540330973.aab0174-3.27.1 | SUSE-RU-2021:0351-1, SUSE-RU-2018:3638-1 |
| SUSE OpenStack Cloud 8 | ardana-service | 8.0+git.1537825617.23552c2-3.14.2 | SUSE-RU-2018:3638-1 |
| SUSE OpenStack Cloud 8 | ardana-service-ansible | 8.0+git.1537806377.25b5d68-3.11.2 | SUSE-RU-2018:3638-1 |
| SUSE OpenStack Cloud 8 | ardana-ses | 8.0+git.1539113493.6631423-1.8.2 | SUSE-RU-2018:3638-1 |
| SUSE OpenStack Cloud 8 | ardana-swift | 8.0+git.1534267211.78fb7e3-3.18.2 | SUSE-RU-2018:3638-1 |
| SUSE OpenStack Cloud 8 | kibana | 4.6.3-3.6.1 | SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud 8 | openstack-neutron +1 | 11.0.9~dev69-3.40.1 | SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud 8 | openstack-nova +1 | 16.1.9~dev78-3.45.1 | SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud 8 | python-Django | 1.11.29-3.22.1 | SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud 8 | release-notes-suse-openstack-cloud | 8.20201214-3.29.1 | SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud 8 | spark | 1.6.3-8.6.1 | SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-horizon | 12.0.5~dev6-14.34.3 | SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-neutron | 11.0.9~dev69-13.36.1 | SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-nova | 16.1.9~dev78-11.34.1 | SUSE-RU-2021:0351-1 |
| SUSE OpenStack Cloud 7 | crowbar | 4.0+git.1528801103.f5708341-7.20.1 | SUSE-SU-2018:2603-1 |
| SUSE OpenStack Cloud 7 | crowbar-core | 4.0+git.1534246408.3ab19c567-9.33.1 | SUSE-SU-2018:2603-1 |
| SUSE OpenStack Cloud 7 | crowbar-ha | 4.0+git.1533750802.5768e73-4.34.1 | SUSE-SU-2018:2603-1 |
| SUSE OpenStack Cloud 7 | crowbar-openstack | 4.0+git.1534254269.ce598a9fe-9.39.1 | SUSE-SU-2020:3624-1, SUSE-SU-2018:2603-1 |
| SUSE OpenStack Cloud 7 | crowbar-ui | 1.1.0+git.1533844061.4ac8e723-4.3.1 | SUSE-SU-2018:2603-1 |
| SUSE OpenStack Cloud 7 | grafana | 6.7.4-1.20.1 | SUSE-SU-2020:3624-1 |
| SUSE OpenStack Cloud 7 | influxdb | 1.2.4-5.1 | SUSE-SU-2020:3624-1 |
| SUSE OpenStack Cloud 7 | python-urllib3 | 1.16-3.12.1 | SUSE-SU-2020:3624-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE HPE Helion OpenStack 8 | ardana-ansible | 8.0+git.1539739656.0ef51c9-3.46.1 | SUSE-RU-2018:3638-1 |
| SUSE HPE Helion OpenStack 8 | ardana-barbican | 8.0+git.1534266594.8136db7-4.27.2 | SUSE-RU-2018:3638-1 |
| SUSE HPE Helion OpenStack 8 | ardana-cinder | 8.0+git.1535412193.d9ad231-3.27.2 | SUSE-RU-2018:3638-1 |
| SUSE HPE Helion OpenStack 8 | ardana-cluster | 8.0+git.1534266734.ec4822f-3.30.2 | SUSE-RU-2018:3638-1 |
| SUSE HPE Helion OpenStack 8 | ardana-cobbler | 8.0+git.1534780521.780753b-3.29.2 | SUSE-RU-2018:3638-1 |
| SUSE HPE Helion OpenStack 8 | ardana-freezer | 8.0+git.1534266805.c9ea29b-3.12.2 | SUSE-RU-2018:3638-1 |
| SUSE HPE Helion OpenStack 8 | ardana-glance | 8.0+git.1537790499.b15fdea-3.8.2 | SUSE-RU-2018:3638-1 |
| SUSE HPE Helion OpenStack 8 | ardana-horizon | 8.0+git.1610733160.0f577f4-3.21.1 | SUSE-RU-2021:0351-1 |
| SUSE HPE Helion OpenStack 8 | ardana-input-model | 8.0+git.1539086744.5ae1d6f-3.21.2 | SUSE-RU-2018:3638-1 |
| SUSE HPE Helion OpenStack 8 | ardana-keystone | 8.0+git.1536100286.ddd8d3e-3.15.2 | SUSE-RU-2018:3638-1 |
| SUSE HPE Helion OpenStack 8 | ardana-logging | 8.0+git.1610573640.452aed1-3.27.1 | SUSE-RU-2021:0351-1 |
| SUSE HPE Helion OpenStack 8 | ardana-monasca | 8.0+git.1610740501.5dca121-3.27.1 | SUSE-RU-2021:0351-1 |
| SUSE HPE Helion OpenStack 8 | ardana-mq | 8.0+git.1534267034.f95e1ec-3.5.2 | SUSE-RU-2021:0351-1, SUSE-RU-2018:3638-1 |
| SUSE HPE Helion OpenStack 8 | ardana-neutron | 8.0+git.1537805998.7898f24-3.21.2 | SUSE-RU-2018:3638-1 |
| SUSE HPE Helion OpenStack 8 | ardana-nova | 8.0+git.1537895345.35a03a2-3.14.2 | SUSE-RU-2018:3638-1 |
| SUSE HPE Helion OpenStack 8 | ardana-octavia | 8.0+git.1534267086.b7dbe77-3.8.2 | SUSE-RU-2018:3638-1 |
| SUSE HPE Helion OpenStack 8 | ardana-osconfig | 8.0+git.1540330973.aab0174-3.27.1 | SUSE-RU-2021:0351-1, SUSE-RU-2018:3638-1 |
| SUSE HPE Helion OpenStack 8 | ardana-service | 8.0+git.1537825617.23552c2-3.14.2 | SUSE-RU-2018:3638-1 |
| SUSE HPE Helion OpenStack 8 | ardana-service-ansible | 8.0+git.1537806377.25b5d68-3.11.2 | SUSE-RU-2018:3638-1 |
| SUSE HPE Helion OpenStack 8 | ardana-ses | 8.0+git.1539113493.6631423-1.8.2 | SUSE-RU-2018:3638-1 |
| SUSE HPE Helion OpenStack 8 | ardana-swift | 8.0+git.1534267211.78fb7e3-3.18.2 | SUSE-RU-2018:3638-1 |
| SUSE HPE Helion OpenStack 8 | kibana | 4.6.3-3.6.1 | SUSE-RU-2021:0351-1 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron +1 | 11.0.9~dev69-3.40.1 | SUSE-RU-2021:0351-1 |
| SUSE HPE Helion OpenStack 8 | openstack-nova +1 | 16.1.9~dev78-3.45.1 | SUSE-RU-2021:0351-1 |
| SUSE HPE Helion OpenStack 8 | python-Django | 1.11.29-3.22.1 | SUSE-RU-2021:0351-1 |
| SUSE HPE Helion OpenStack 8 | release-notes-hpe-helion-openstack | 8.20201214-3.29.1 | SUSE-RU-2021:0351-1 |
| SUSE HPE Helion OpenStack 8 | spark | 1.6.3-8.6.1 | SUSE-RU-2021:0351-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-horizon-hpe | 12.0.5~dev6-14.34.1 | SUSE-RU-2021:0351-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-neutron | 11.0.9~dev69-13.36.1 | SUSE-RU-2021:0351-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-nova | 16.1.9~dev78-11.34.1 | SUSE-RU-2021:0351-1 |
| SUSE Enterprise Storage 4 | crowbar | 4.0+git.1528801103.f5708341-7.20.1 | SUSE-SU-2018:2603-1 |
| SUSE Enterprise Storage 4 | crowbar-core | 4.0+git.1534246408.3ab19c567-9.33.1 | SUSE-SU-2018:2603-1 |
Advisories 5
- SUSE-RU-2021:0351-1 Recommended update for ardana-horizon, ardana-logging, ardana-monasca, ardana-mq, ardana-osconfig, crowbar-ha, crowbar-openstack, kibana, openstack-neutron, openstack-nova, python-Django, release-notes-suse-openstack-cloud, sleshammer, spark SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2603-1 Security update for crowbar, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-RU-2018:3638-1 Recommended update for ardana-ansible SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2762-1 Security update for crowbar, crowbar-core, crowbar-ha, crowbar-init, crowbar-openstack, crowbar-ui SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:3624-1 Security update for crowbar-openstack, grafana, influxdb, python-urllib3 SUSE / openSUSE Security Updates · May 2, 2025