CVE-2014-9493: Medium severity redhat Openstack vulnerability

Q: What is the severity of CVE-2014-9493?

CVE-2014-9493 is rated as high severity due to the potential for authenticated users to read or delete arbitrary files.

Q: How do I fix CVE-2014-9493?

To fix CVE-2014-9493, update your OpenStack Glance to a version higher than 2014.2.2 or 2014.1.4.

Q: Who is affected by CVE-2014-9493?

CVE-2014-9493 affects installations of OpenStack Image Registry and Delivery Service (Glance) versions before 2014.2.2 and 2014.1.4.

Q: What type of vulnerability is CVE-2014-9493?

CVE-2014-9493 is a path traversal vulnerability that allows remote authenticated users to access unauthorized files.

Q: Can CVE-2014-9493 be exploited remotely?

Yes, CVE-2014-9493 can be exploited remotely by authenticated users through crafted file: URLs.

Published Jan 7, 2015

Updated

The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete arbitrary files via a full pathname in a file: URL in the image location property.

Affected Software

4 affected components

redhat Openstack=4.0

redhat Openstack=5.0

Openstack Image Registry And Delivery Service \(glance\)>=2014.1<2014.1.4

Openstack Image Registry And Delivery Service \(glance\)>=2014.2<2014.2.2

Remediation

Patch Available

http://lists.openstack.org/pipermail/openstack-announce/2014-December/000317.html

Event History

Jan 7, 2015

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-9493?

CVE-2014-9493 is rated as high severity due to the potential for authenticated users to read or delete arbitrary files.

How do I fix CVE-2014-9493?