CVE-2015-5286: Medium severity openstack glance vulnerability
OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5286?
CVE-2015-5286 is considered a moderate severity vulnerability due to its potential to cause denial of service through disk consumption.
How do I fix CVE-2015-5286?
To fix CVE-2015-5286, upgrade OpenStack Glance to version 2014.2.4 or 2015.1.2 or later.
Who is affected by CVE-2015-5286?
CVE-2015-5286 affects remote authenticated users of OpenStack Image Service (Glance) versions prior to 2014.2.4 and 2015.1.2.
What causes the vulnerability in CVE-2015-5286?
The vulnerability in CVE-2015-5286 allows users to bypass storage quotas by deleting images that are in the process of being uploaded.
Is there a workaround for CVE-2015-5286?
There are no officially documented workarounds for CVE-2015-5286, so the recommended action is to apply the patch or upgrade.