CVE-2013-1840
CVE-2013-1840
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image.
EPSS 1.4% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
glance Debian:12
- Affected ranges
- ECOSYSTEM: < 2012.1.1-5
Update to 2012.1.1-5
glance Debian:13
- Affected ranges
- ECOSYSTEM: < 2012.1.1-5
Update to 2012.1.1-5
glance Debian:14
- Affected ranges
- ECOSYSTEM: < 2012.1.1-5
Update to 2012.1.1-5
glance PyPI
- Affected ranges
- ECOSYSTEM: < 11.0.0a0
Update to 11.0.0a0
glance PyPI
- Affected ranges
- ECOSYSTEM: ≤ v1
No fix published
Original sources
- https://exchange.xforce.ibmcloud.com/vulnerabilities/82878
- https://review.openstack.org/#/c/24437/
- http://www.ubuntu.com/usn/USN-1764-1
- https://review.openstack.org/#/c/24438/
- https://bugs.launchpad.net/glance/+bug/1135541
- http://secunia.com/advisories/52565
- http://rhn.redhat.com/errata/RHSA-2013-0707.html
- http://osvdb.org/91304
- http://www.openwall.com/lists/oss-security/2013/03/14/15
- http://www.securityfocus.com/bid/58490
- https://review.openstack.org/#/c/24439/
- https://nvd.nist.gov/vuln/detail/CVE-2013-1840