The v2 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protected images via an image deletion request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4573.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The v2 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated
    users to delete arbitrary non-protected images via an image deletion request. NOTE: this vulnerability
    exists because of an incomplete fix for CVE-2012-4573. (CVE-2012-5482)

- Fix Glance Authentication bypass for image deletion

    - Update to stable/essex 2012.1.2 including...

    - Support zero-size image creation via the v1 API

    - Allow admins to share images regardless of owner

    - Log sensitive store info, rather than exposing over       API

    - Fix the qpid_heartbeat option to avoid connection       timeouts

    - Fix image.upload notification to not send stale       metadata

    - Include chunk_name in swift debug message

    - Fix scrubber exception when microsecs in DB       (PostgreSQL) dates

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fix Glance Authentication bypass for image deletion     (CVE-2012-4573)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
433142	SCA: security update for glance (GHSA-vwr9-9f8v-vp5m)	Tenable Cloud Security	SCA Checks	medium
433142	SCA: security update for glance (GHSA-vwr9-9f8v-vp5m)	Tenable Self-Hosted Container Security	SCA Checks	medium
62978	Fedora 17 : openstack-glance-2012.1.2-2.fc17 (2012-18085)	Nessus	Fedora Local Security Checks	medium
62914	Fedora 18 : openstack-glance-2012.2-3.fc18 (2012-17901)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-5482

medium

Tenable Plugins

medium

medium

medium

medium