CVE-2015-5286

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-5286
OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:C

Exploitability : 8.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References
Link Resource
http://rhn.redhat.com/errata/RHSA-2015-1897.html
http://www.securityfocus.com/bid/76943
https://bugs.launchpad.net/bugs/1498163
https://security.openstack.org/ossa/OSSA-2015-020.html Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):*:*:*:*:*:*:*:*
cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):2015.1.0:*:*:*:*:*:*:*
cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):2015.1.1:*:*:*:*:*:*:*
History

07 Nov 2023, 02:26

Type Values Removed Values Added
Summary OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.

12 Feb 2023, 23:15

Type Values Removed Values Added
Summary A race-condition flaw was discovered in the OpenStack Image service (glance). When images in the upload state were deleted using a token close to expiration, untracked image data could accumulate in the back end. Because untracked data does not count towards the storage quota, an attacker could use this flaw to cause a denial of service through resource exhaustion. OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.
References
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1267516', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1267516', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2015-5286', 'name': 'https://access.redhat.com/security/cve/CVE-2015-5286', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:1897', 'name': 'https://access.redhat.com/errata/RHSA-2015:1897', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 21:15

Type Values Removed Values Added
References
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1267516 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2015-5286 -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:1897 -
Summary OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. A race-condition flaw was discovered in the OpenStack Image service (glance). When images in the upload state were deleted using a token close to expiration, untracked image data could accumulate in the back end. Because untracked data does not count towards the storage quota, an attacker could use this flaw to cause a denial of service through resource exhaustion.
Information

Published : 2015-10-26 17:59

Updated : 2023-12-10 11:46

NVD link : CVE-2015-5286

Mitre link : CVE-2015-5286

CVE.ORG link : CVE-2015-5286

JSON object : View

Products Affected

openstack

  • image_registry_and_delivery_service_\(glance\)
CWE
CWE-264

Permissions, Privileges, and Access Controls