GHSA-g2j5-7vgx-6xrx

Source
https://github.com/advisories/GHSA-g2j5-7vgx-6xrx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-g2j5-7vgx-6xrx/GHSA-g2j5-7vgx-6xrx.json
Aliases
  • CVE-2015-5162
Published
2022-05-14T03:59:07Z
Modified
2023-11-08T03:57:56.275708Z
Details

The image parser in OpenStack Cinder prior to 7.0.2, and 8.0.0 and above, prior to 9.0.0; Glance prior to 14.00; and Nova prior to 12.0.4 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image. This issue is patched in Cinder 7.0.2 and 9.0.0; Glance 14.0.0; and Nova 12.0.4

References

Affected packages

PyPI / cinder

Package

Name
cinder

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
7.0.2

PyPI / cinder

Package

Name
cinder

Affected ranges

Type
ECOSYSTEM
Events
Introduced
8.0.0
Fixed
9.0.0

PyPI / glance

Package

Name
glance

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
14.0.0

PyPI / nova

Package

Name
nova

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
12.0.4