7.8

CVE-2015-5162: openstack cinder Resource Management Errors

CVSS: 7.8v2.0HighModified
AliasesGHSA-g2j5-7vgx-6xrxPYSEC-2026-2412PYSEC-2026-2491
Published 07-10-2016Last modified 06-08-2024
Open JSON

Vulnerability summary

CVE-2015-5162 is a high (CVSS 7.8) Resource Management Errors vulnerability in openstack cinder. EPSS estimates a 3.09% chance of exploitation in the next 30 days, higher than 87.5% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
42/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v2.0 (NVD)
EPSS score
3.09%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
USN-3449-1

Timeline

  1. 07-10-2016
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

3.09%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

0.00 pp

From 3.09% on 18-09-2026

18-09-202618-10-2026
EPSS score
3.09%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (launchpad.net)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Redhat26 products
  • openstack-cinder< 1:8.1.1-4.el7ost | < 1:7.0.3-1.el7ost | < 0:2014.1.5-9.el7ost | < 0:2014.2.4-11.el7ost | < 0:2014.1.5-9.el6ost | < 0:2015.1.3-12.el7ost
  • openstack-cinder-doc< 0:2014.1.5-9.el7ost | < 0:2014.2.4-11.el7ost | < 0:2014.1.5-9.el6ost | < 0:2015.1.3-12.el7ost
  • openstack-glance< 1:12.0.0-2.el7ost | < 1:11.0.1-6.el7ost | < 0:2015.1.2-3.el7ost
  • openstack-glance-doc< 0:2015.1.2-3.el7ost
  • openstack-nova< 1:12.0.5-9.el7ost | < 0:2015.1.4-32.el7ost
Debian3 products
  • cinder< 2:8.0.0-1
  • glance< 2:12.0.0-1
  • nova< 2:13.0.0-1
Openstack3 products
  • cinder7.0.2 | 8.0.0 | 8.1.0
  • glance≤ 11.0.0 | 11.0.1 | 12.0.0
  • nova≤ 12.0.3 | 13.0.0
PyPI3 products
  • cinder< 7.0.2 | ≥ 8.0.0, < 9.0.0
  • glance< 14.0.0
  • nova< 12.0.4
Ubuntu1 product
  • nova< 1:2014.1.5-0ubuntu1.7

5 vendors · 36 products

References

70 links
Show all 70 references