CVE-2014-9684: openstack image_registry_and_delivery_service_\(glance\) Resource Management Errors

EPSS trend

Probability

2.00%

Chance of exploitation in the next 30 days

Percentile

80%

Versus all other CVEs

30-day change

0.00 pp

From 2.00% on 19-09-2026

19-09-202619-10-2026

EPSS score

2.00%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugs.launchpad.net)
Maturity: unknown

References

19 links

lists.openstack.org/pipermail/openstack-announce/2015-February/000336.htmlMailing ListX Refsource MLISTVendor AdvisoryWEBAdvisory
bugs.launchpad.net/glance/+bug/1371118X Refsource CONFIRMExploitWEBEVIDENCE
rhn.redhat.com/errata/RHSA-2015-0938.htmlVendor AdvisoryX Refsource REDHATWEBAdvisory
www.securityfocus.com/bid/72692VDB EntryX Refsource BIDWEB
www.suse.com/support/update/announcement/2015/suse-su-20151515-1/Advisory
bugzilla.suse.com/918784REPORT
bugzilla.suse.com/920573REPORT
bugzilla.suse.com/926596REPORT
bugzilla.suse.com/928718REPORT
bugzilla.suse.com/930574REPORT

Show all 19 references

Related vulnerabilities

CVE-2013-0212canonicalubuntu_linux+62.99%13y ago24-02-2013 21:00store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.CVE-2013-4354debianglance+10.35%12y ago23-11-2013 17:00The API before 2.1 in OpenStack Image Registry and Delivery Service (Glance) makes it easier for local users to inject images into arbitrary tenants by adding the tenant as a member of the image.CVE-2015-1195debianglance+22.79%11y ago21-01-2015 18:00The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.CVE-2015-1881openstackimage_registry_and_delivery_service_\(glance\)+12.12%11y ago24-02-2015 15:00OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them, a different vulnerability than CVE-2014-9684.CVE-2015-5286chainguardopenstack-glance-2025.1+122.40%10y ago26-10-2015 17:00OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.CVE-2015-5251debianglance+32.05%10y ago26-10-2015 17:00OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

All vulnerabilities inimage_registry_and_delivery_service_\(glance\)

CVE-2014-9684: openstack image_registry_and_delivery_service_\(glance\) Resource Management Errors

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References