CVE-2014-9493

Publication date 7 January 2015

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete arbitrary files via a full pathname in a file: URL in the image location property.

Read the notes from the security team

Status

Package Ubuntu Release Status
glance 15.04 vivid
Not affected
14.10 utopic
Not affected
14.04 LTS trusty
Fixed 1:2014.1.4-0ubuntu1
12.04 LTS precise
Not affected
10.04 LTS lucid Not in release

Notes

jdstrand

Per upstream, "A potential mitigation strategy available for operators is to change the glance policy to restrict access to administrators for get_image_location, set_image_location, and delete_image_location." Ubuntu 12.04 LTS not affected (does not have V2 API) preliminary packages for Ubuntu 14.04 LTS and 14.10 can be found in: https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+packages

mdeslaur

This issue wasn't fully addressed by the original patches, see: http://lists.openstack.org/pipermail/openstack-announce/2015-January/000323.html incomplete fix got CVE-2015-1195

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
glance