Vulnerability Details CVE-2015-5286
OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 44.0%
CVSS Severity
CVSS v2 Score 6.8
References
- http://rhn.redhat.com/errata/RHSA-2015-1897.html
- http://www.securityfocus.com/bid/76943
- https://bugs.launchpad.net/bugs/1498163
- https://security.openstack.org/ossa/OSSA-2015-020.html
- http://rhn.redhat.com/errata/RHSA-2015-1897.html
- http://www.securityfocus.com/bid/76943
- https://bugs.launchpad.net/bugs/1498163
- https://security.openstack.org/ossa/OSSA-2015-020.html
Products affected by CVE-2015-5286
-
cpe:2.3:a:openstack:image_registry_and_delivery_service_(glance):-
-
cpe:2.3:a:openstack:image_registry_and_delivery_service_(glance):2013.2
-
cpe:2.3:a:openstack:image_registry_and_delivery_service_(glance):2013.2.1
-
cpe:2.3:a:openstack:image_registry_and_delivery_service_(glance):2013.2.2
-
cpe:2.3:a:openstack:image_registry_and_delivery_service_(glance):2013.2.3
-
cpe:2.3:a:openstack:image_registry_and_delivery_service_(glance):2013.2.4
-
cpe:2.3:a:openstack:image_registry_and_delivery_service_(glance):2014.1
-
cpe:2.3:a:openstack:image_registry_and_delivery_service_(glance):2014.1.1
-
cpe:2.3:a:openstack:image_registry_and_delivery_service_(glance):2014.1.2
-
cpe:2.3:a:openstack:image_registry_and_delivery_service_(glance):2014.1.3
-
cpe:2.3:a:openstack:image_registry_and_delivery_service_(glance):2014.1.4
-
cpe:2.3:a:openstack:image_registry_and_delivery_service_(glance):2014.2
-
cpe:2.3:a:openstack:image_registry_and_delivery_service_(glance):2014.2.1
-
cpe:2.3:a:openstack:image_registry_and_delivery_service_(glance):2014.2.2
-
cpe:2.3:a:openstack:image_registry_and_delivery_service_(glance):2015.1.0
-
cpe:2.3:a:openstack:image_registry_and_delivery_service_(glance):2015.1.1