CVE-2015-5163

Published: 19 August 2015

The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.

Status

Notes

kilo only

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5163
• http://lists.openstack.org/pipermail/openstack-announce/2015-August/000527.html
• NVD
• Launchpad
• Debian

Bugs

• https://bugs.launchpad.net/glance/+bug/1471912
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=795453