Vulnerability Name:

CVE-2014-5356 (CCN-95359)

Assigned:2014-08-19
Published:2014-08-19
Updated:2017-01-07
Summary:OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)
3.0 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-264
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2014-5356

Source: REDHAT
Type: UNKNOWN
RHSA-2014:1337

Source: REDHAT
Type: UNKNOWN
RHSA-2014:1338

Source: REDHAT
Type: UNKNOWN
RHSA-2014:1685

Source: CCN
Type: oss-security Mailing List, Tue, 19 Aug 2014 10:43:23 -0400
CVE request for vulnerability in OpenStack Glance

Source: CCN
Type: oss-security Mailing List, Tue, 19 Aug 2014 10:59:39 -0400
Re: CVE request for vulnerability in OpenStack Glance

Source: SECUNIA
Type: UNKNOWN
60743

Source: CCN
Type: IBM Security Bulletin 1021988
IBM SmartCloud Entry Glance Vulnerabilities (CVE-2014-5356)

Source: CCN
Type: IBM Security Bulletin 1021989
IBM Cloud Manager with OpenStack Glance Vulnerabilities (CVE-2014-5356)

Source: MLIST
Type: UNKNOWN
[oss-security] 20140821 [OSSA 2014-028] Glance store DoS through disk space exhaustion (CVE-2014-5356)

Source: CCN
Type: BID-69280
OpenStack Glance Image Registry and Delivery Service Denial of Service Vulnerability

Source: UBUNTU
Type: UNKNOWN
USN-2322-1

Source: CCN
Type: OSSA 2014-028
image_size_cap not checked in v2

Source: MISC
Type: UNKNOWN
https://bugs.launchpad.net/glance/+bug/1315321

Source: XF
Type: UNKNOWN
openstack-glance-registry-dos(95359)

Source: CCN
Type: OpenStack Glance Web Site
OpenStack Glance

Vulnerable Configuration:Configuration 1:
  • cpe:/a:openstack:image_registry_and_delivery_service_(glance):2013.2:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:image_registry_and_delivery_service_(glance):2013.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:image_registry_and_delivery_service_(glance):2013.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:image_registry_and_delivery_service_(glance):*:*:*:*:*:*:*:* (Version <= 2013.2.3)
  • OR cpe:/a:openstack:image_registry_and_delivery_service_(glance):2014.1:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:image_registry_and_delivery_service_(glance):2014.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:image_registry_and_delivery_service_(glance):2014.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:image_registry_and_delivery_service_(glance):juno-1:*:*:*:*:*:*:*
  • OR cpe:/a:openstack:image_registry_and_delivery_service_(glance):juno-2:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

    • Configuration CCN 1:
  • cpe:/a:openstack:glance:2013.2:milestone1:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:55234
    P
    		Security update for cpio (Important)
    2021-08-23
    oval:org.opensuse.security:def:55917
    P
    		Security update for apache2 (Important)
    2021-06-17
    oval:org.opensuse.security:def:56402
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55071
    P
    		bzip2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56476
    P
    		Security update for tcpdump (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55472
    P
    		Security update for unzip (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56202
    P
    		Security update for sssd (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55072
    P
    		ceph-common on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56514
    P
    		Security update for kernel-firmware (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55645
    P
    		Security update for vorbis-tools (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56310
    P
    		Security update for samba (Important)
    2020-12-01
    oval:org.opensuse.security:def:55094
    P
    		dosfstools on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56595
    P
    		Security update for libXcursor (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55751
    P
    		Security update for strongswan (Important)
    2020-12-01
    oval:org.opensuse.security:def:20145356
    V
    		CVE-2014-5356
    2020-11-28
    oval:org.mitre.oval:def:26460
    P
    		USN-2322-1 -- glance vulnerability
    2014-10-27
    oval:com.ubuntu.precise:def:20145356000
    V
    		CVE-2014-5356 on Ubuntu 12.04 LTS (precise) - medium.
    2014-08-25
    oval:com.ubuntu.trusty:def:20145356000
    V
    		CVE-2014-5356 on Ubuntu 14.04 LTS (trusty) - medium.
    2014-08-25
    BACK
    openstack image registry and delivery service (glance) 2013.2
    openstack image registry and delivery service (glance) 2013.2.1
    openstack image registry and delivery service (glance) 2013.2.2
    openstack image registry and delivery service (glance) *
    openstack image registry and delivery service (glance) 2014.1
    openstack image registry and delivery service (glance) 2014.1.1
    openstack image registry and delivery service (glance) 2014.1.2
    openstack image registry and delivery service (glance) juno-1
    openstack image registry and delivery service (glance) juno-2
    canonical ubuntu linux 14.04
    openstack glance 2013.2 milestone1