Bugzilla – Bug 913645
VUL-0: CVE-2015-1195: openstack-glance: Glance v2 API unrestricted path traversal through filesystem:// scheme
Last modified: 2016-04-27 18:59:57 UTC
CVE-2015-1195 Affects ~~~~~~~ - Glance: up to 2014.1.3 and 2014.2 versions up to 2014.2.1 Description ~~~~~~~~~~~ Jin Liu from EMC reported that path traversal vulnerabilities in Glance were not fully patched in OSSA 2014-041. By setting a malicious image location to a filesystem:// scheme an authenticated user can still download or delete any file on the Glance server for which the Glance process user has access to. Only setups using the Glance V2 API are affected by this flaw. Patches ~~~~~~~ - https://review.openstack.org/145974 (Icehouse) - https://review.openstack.org/145916 (Juno) - https://review.openstack.org/145640 (Kilo) Credits ~~~~~~~ - Jin Liu from EMC Notes ~~~~~ - This fix was included in the kilo-1 development milestone and will be included in future 2014.2.2 (juno) and 2014.1.4 (icehouse) releases. - The OpenStack VMT recommends revoking all credentials stored in files accessible by Glance as a precautionary measure. - A CVE has been requested for this issue, the OpenStack VMT will issue an errata with the correct CVE number assigned once this information is available. References: https://launchpad.net/bugs/1408663 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1195 http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1195.html
bugbot adjusting priority
fix is in the pipeline for Icehouse and Juno except for Havana / SUSE-Cloud 3 that would need conflict resolving (if it is affected)
An update workflow for this issue was started. This issue was rated as important. Please submit fixed packages until 2015-03-11. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/60917