DSA-5336: -1 glance -- security update
Published Feb 1, 2023
·Updated
glance - security update
Other sources
Guillaume Espanel, Pierre Libeau, Arnaud Morin and Damien Rannou discovered that missing input sanitising in the handling of VMDK images in Glance, the OpenStack image registry and delivery service, may result in information disclosure.
Affected Software
2 affected components
debian/glance
debian/glance
Event History
Feb 1, 2023
Advisory Published
12:00 AM
Frequently Asked Questions
1
What conditions are required for exploitation?
The issue is triggered through handling of VMDK images in Glance. The provided information does not specify whether an attacker must be authenticated or what image-upload permissions are required.
2
What is the documented impact?
Missing input sanitising when Glance handles VMDK images may lead to information disclosure.