1. CVE-Search
  2. CVE-2015-3289
ID CVE-2015-3289
Summary OpenStack Glance before 2015.1.1 (kilo) allows remote authenticated users to cause a denial of service (disk consumption) by repeatedly using the import task flow API to create images and then deleting them.
References
Vulnerable Configurations
  • cpe:2.3:a:openstack:glance:0.1.7:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:0.1.7:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:1.0:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2.0:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:11.0.0:-:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:11.0.0:-:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:11.0.0:alpha0:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:11.0.0:alpha0:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:11.0.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:11.0.0:beta1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:11.0.0:beta2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:11.0.0:beta2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:11.0.0:beta3:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:11.0.0:beta3:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:11.0.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:11.0.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:11.0.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:11.0.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:11.0.0:rc3:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:11.0.0:rc3:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:11.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:11.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:11.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:11.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:12.0.0:-:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:12.0.0:-:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:12.0.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:12.0.0:beta1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:12.0.0:beta2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:12.0.0:beta2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:12.0.0:beta3:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:12.0.0:beta3:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:12.0.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:12.0.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:12.0.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:12.0.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:13.0.0:-:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:13.0.0:-:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:13.0.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:13.0.0:beta1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:13.0.0:beta2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:13.0.0:beta2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:13.0.0:beta3:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:13.0.0:beta3:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:13.0.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:13.0.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:13.0.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:13.0.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:14.0.0:-:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:14.0.0:-:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:14.0.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:14.0.0:beta1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:14.0.0:beta2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:14.0.0:beta2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:14.0.0:beta3:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:14.0.0:beta3:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:14.0.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:14.0.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:14.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:14.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:15.0.0:-:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:15.0.0:-:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:15.0.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:15.0.0:beta1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:15.0.0:beta2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:15.0.0:beta2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:15.0.0:beta3:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:15.0.0:beta3:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:15.0.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:15.0.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:15.0.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:15.0.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:15.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:15.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:15.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:15.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:16.0.0:-:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:16.0.0:-:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:16.0.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:16.0.0:beta1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:16.0.0:beta2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:16.0.0:beta2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:16.0.0:beta3:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:16.0.0:beta3:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:16.0.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:16.0.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:16.0.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:16.0.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:16.0.0:rc3:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:16.0.0:rc3:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:16.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:16.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:17.0.0:-:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:17.0.0:-:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:17.0.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:17.0.0:beta1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:17.0.0:beta2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:17.0.0:beta2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:17.0.0:beta3:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:17.0.0:beta3:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:17.0.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:17.0.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:17.0.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:17.0.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:18.0.0:-:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:18.0.0:-:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:18.0.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:18.0.0:beta1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:18.0.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:18.0.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2011.2:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2011.2:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2011.3:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2011.3:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2011.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2011.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2012.1:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2012.1:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2012.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2012.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2012.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2012.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2012.2:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2012.2:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2012.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2012.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2012.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2012.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2012.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2012.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2012.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2012.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.1:-:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.1:-:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.1:rc1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.1:rc1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.1:rc2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.1:rc2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.1.4:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.1.5:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.2:-:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.2:-:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.2:beta1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.2:beta1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.2:beta2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.2:beta2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.2:beta3:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.2:beta3:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.2:milestone1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.2:milestone1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.2:milestone2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.2:milestone2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.2:milestone3:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.2:milestone3:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.2:rc1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.2:rc1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.2:rc2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.2:rc2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2013.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2013.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.1:-:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.1:-:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.1:beta1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.1:beta1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.1:beta2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.1:beta2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.1:beta3:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.1:beta3:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.1:rc1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.1:rc1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.1:rc2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.1:rc2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.1.4:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.1.5:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.2:-:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.2:-:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.2:beta1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.2:beta1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.2:beta2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.2:beta2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.2:beta3:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.2:beta3:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.2:rc1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.2:rc1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.2:rc2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.2:rc2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.2:rc3:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.2:rc3:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2014.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2014.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2015.1.0:-:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2015.1.0:-:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2015.1.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2015.1.0:beta1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2015.1.0:beta2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2015.1.0:beta2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2015.1.0:beta3:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2015.1.0:beta3:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2015.1.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2015.1.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:glance:2015.1.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:openstack:glance:2015.1.0:rc2:*:*:*:*:*:*
CVSS
Base: 4.0 (as of 03-12-2016 - 03:09)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:S/C:N/I:N/A:P
refmap via4
bid 76068
confirm https://bugs.launchpad.net/glance/+bug/1454087
mlist [openstack-announce] 20150728 [OSSA 2015-013] Glance task flow may fail to delete image from backend
Last major update 03-12-2016 - 03:09
Published 14-08-2015 - 18:59
Last modified 03-12-2016 - 03:09
Back to Top