OpenStack Image Registry Vulnerability in Glance Affects Multiple Tenants
CVE-2013-4354

Currently unrated

Key Information:

Vendor

Openstack
Status
Image Registry And Delivery Service \(glance\)
Vendor
CVE Published:
23 November 2013

What is CVE-2013-4354?

A vulnerability exists in the OpenStack Image Registry and Delivery Service (Glance) prior to version 2.1 that permits local users to inject images into arbitrary tenant accounts. This occurs due to the software allowing the addition of a tenant as a member of any image, thereby compromising the data integrity and confidentiality of the tenant's images.

References

http://www.openwall.com/lists/oss-security/2013/09/19/3
mailing-listx_refsource_MLIST
https://bugs.launchpad.net/glance/+bug/1226078
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2013/09/19/2
mailing-listx_refsource_MLIST

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2013-4354 : OpenStack Image Registry Vulnerability in Glance Affects Multiple Tenants