CVE-2013-4428

OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and Havana before 2013.2, when the download_image policy is configured, does not properly restrict access to cached images, which allows remote authenticated users to read otherwise restricted images via an image UUID.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
3.5 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:S/C:P/I:N/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 51%
VendorProductVersion
openstackglance
2012.2 ≤
𝑥
≤ 2012.2.4
openstackglance
2013.1 ≤
𝑥
< 2013.1.4
openstackglance
2013.2:milestone1
openstackglance
2013.2:milestone2
openstackglance
2013.2:milestone3
canonicalubuntu_linux
12.10
canonicalubuntu_linux
13.04
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
glance
bullseye
2:21.0.0-2+deb11u1
fixed
wheezy
not-affected
bullseye (security)
2:21.1.0-1+deb11u2
fixed
bookworm
2:25.1.0-2+deb12u1
fixed
bookworm (security)
2:25.1.0-2+deb12u1
fixed
sid
2:29.0.0-1
fixed
trixie
2:29.0.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
glance
saucy
not-affected
raring
Fixed 1:2013.1.3-0ubuntu1.1
released
quantal
Fixed 2012.2.4-0ubuntu1.1
released
precise
not-affected
lucid
dne
Common Weakness Enumeration
References
http://rhn.redhat.com/errata/RHSA-2013-1525.html
http://www.openwall.com/lists/oss-security/2013/10/15/8
http://www.openwall.com/lists/oss-security/2013/10/16/9
http://www.securityfocus.com/bid/63159
http://www.ubuntu.com/usn/USN-2003-1
https://bugs.launchpad.net/glance/+bug/1235226
https://bugs.launchpad.net/glance/+bug/1235378
https://launchpad.net/glance/+milestone/2013.1.4
https://launchpad.net/glance/+milestone/2013.2
http://rhn.redhat.com/errata/RHSA-2013-1525.html
http://www.openwall.com/lists/oss-security/2013/10/15/8
http://www.openwall.com/lists/oss-security/2013/10/16/9
http://www.securityfocus.com/bid/63159
http://www.ubuntu.com/usn/USN-2003-1
https://bugs.launchpad.net/glance/+bug/1235226
https://bugs.launchpad.net/glance/+bug/1235378
https://launchpad.net/glance/+milestone/2013.1.4
https://launchpad.net/glance/+milestone/2013.2