Description
A vulnerability was found in python-glance-store. The issue occurs when the package logs the access_key for the glance-store when the DEBUG log level is enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | glance-store | < 4.7.0 | 4.7.0 |
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 9 | — | — |
| Red Hat | Red Hat OpenStack Platform 16.1 | — | — |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | — |
| Red Hat | Red Hat OpenStack Platform 18.0 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-glance-store | 4.7.0-2 | — |
| Debian 13 | python-glance-store | 4.7.0-2 | — |
| Debian 12 | python-glance-store | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | python-glance-store | 4.6.1-0ubuntu3 | — |
| Ubuntu 22.04 LTS | python-glance-store | 3.0.0-0ubuntu1.4 | USN-6630-1 |
| Ubuntu 20.04 LTS | python-glance-store | 2.0.0-0ubuntu4.3 | USN-6630-1 |
| Ubuntu 18.04 LTS | python-glance-store | No fix yet | — |
| Ubuntu 16.04 LTS | python-glance-store | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 17 | python-glance-store +1 | 2.5.1-17.1.20230621023901.el9ost | RHSA-2024:2732 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | glance-store | <= 4.6.1 | — | GHSA-wgpq-p2hm-56v9 |
| PyPI | glance-store | < 4.7.0 | 4.7.0 | PYSEC-2026-1405 |
Advisories 3
- RHSA-2024:2732 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-glance-store) security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- USN-6630-1 python-glance-store vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- WID-SEC-2024-1228 Red Hat OpenStack: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2026
References
- RHSA-2024:2732 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-1141 vdb-entry
- RHBZ#2258836 issue-tracking