oss-security - [OSSA 2015-002.1] Glance v2 API unrestricted path traversal through filesystem:// scheme (CVE-2015-1195) ERRATA 1

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <54BE6C0D.1080404@enovance.com>
Date: Tue, 20 Jan 2015 09:54:05 -0500
From: Tristan Cacqueray <tristan.cacqueray@...vance.com>
To: oss-security@...ts.openwall.com
Subject: [OSSA 2015-002.1] Glance v2 API unrestricted path traversal through
 filesystem:// scheme (CVE-2015-1195) ERRATA 1

=======================================================================================
OSSA-2015-002.1: Glance v2 API unrestricted path traversal through filesystem:// scheme
=======================================================================================

:Date: January 20, 2015
:CVE: CVE-2015-1195


Affects
~~~~~~~
- Glance: up to 2014.1.3 and 2014.2 versions up to 2014.2.1


Description
~~~~~~~~~~~
Jin Liu from EMC reported that path traversal vulnerabilities in
Glance were not fully patched in OSSA 2014-041. By setting a malicious
image location to a filesystem:// scheme an authenticated user can
still download or delete any file on the Glance server for which the
Glance process user has access to. Only setups using the Glance V2 API
are affected by this flaw.


Errata
~~~~~~
When the original advisory was published a CVE number was not
assigned. CVE-2015-1195 can now be used to track this vulnerability.


Patches
~~~~~~~
- https://review.openstack.org/145974 (Icehouse)
- https://review.openstack.org/145916 (Juno)
- https://review.openstack.org/145640 (Kilo)


Credits
~~~~~~~
- Jin Liu from EMC (CVE-2015-1195)


References
~~~~~~~~~~
- https://launchpad.net/bugs/1408663
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1195


Notes
~~~~~
- This fix was included in the kilo-1 development milestone and will be
  included in future 2014.2.2 (juno) and 2014.1.4 (icehouse) releases.
- The OpenStack VMT recommends revoking all credentials stored in files
  accessible by Glance as a precautionary measure.


OSSA History
~~~~~~~~~~~~
- 2015-01-20 - Errata 1
- 2015-01-15 - Original Version

--
Tristan Cacqueray
OpenStack Vulnerability Management Team


Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.