CVE-2013-1840

Currently unrated

Key Information:

Vendor
Openstack
Status
Glance
Vendor
CVE Published:
22 March 2013

Summary

The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/82878
vdb-entryx_refsource_XF
https://review.openstack.org/#/c/24437/
x_refsource_CONFIRM
http://www.ubuntu.com/usn/USN-1764-1
vendor-advisoryx_refsource_UBUNTU

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.