CVE-2014-5356

2014-08-2514:55:07

CWE-264

[email protected]

web.nvd.nist.gov

cve-2014-5356

openstack

glance

image registry

dos

vulnerability

nvd

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

6.1 Medium

AI Score

Confidence

Low

0.007 Low

EPSS

Percentile

80.2%

JSON

OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.

Affected configurations

NVD

Node

openstackimage_registry_and_delivery_service_\(glance\)Range≤2013.2.3

openstackimage_registry_and_delivery_service_\(glance\)Match2013.2

openstackimage_registry_and_delivery_service_\(glance\)Match2013.2.1

openstackimage_registry_and_delivery_service_\(glance\)Match2013.2.2

openstackimage_registry_and_delivery_service_\(glance\)Match2014.1

openstackimage_registry_and_delivery_service_\(glance\)Match2014.1.1

openstackimage_registry_and_delivery_service_\(glance\)Match2014.1.2

openstackimage_registry_and_delivery_service_\(glance\)Matchjuno-1

openstackimage_registry_and_delivery_service_\(glance\)Matchjuno-2

canonicalubuntu_linuxMatch14.04lts

CPENameOperatorVersion
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service (glance)le2013.2.3
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service (glance)eq2013.2
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service (glance)eq2013.2.1
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service (glance)eq2013.2.2
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service (glance)eq2014.1
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service (glance)eq2014.1.1
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service (glance)eq2014.1.2
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service (glance)eqjuno-1
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service (glance)eqjuno-2
canonical:ubuntu_linuxcanonical ubuntu linuxeq14.04

CPE	Name	Operator	Version
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service (glance)	le	2013.2.3
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service (glance)	eq	2013.2
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service (glance)	eq	2013.2.1
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service (glance)	eq	2013.2.2
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service (glance)	eq	2014.1
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service (glance)	eq	2014.1.1
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service (glance)	eq	2014.1.2
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service (glance)	eq	juno-1
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service (glance)	eq	juno-2
canonical:ubuntu_linux	canonical ubuntu linux	eq	14.04