The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location.
{
"binaries": [
{
"binary_name": "glance",
"binary_version": "1:2014.1-0ubuntu1"
},
{
"binary_name": "glance-api",
"binary_version": "1:2014.1-0ubuntu1"
},
{
"binary_name": "glance-common",
"binary_version": "1:2014.1-0ubuntu1"
},
{
"binary_name": "glance-registry",
"binary_version": "1:2014.1-0ubuntu1"
},
{
"binary_name": "python-glance",
"binary_version": "1:2014.1-0ubuntu1"
},
{
"binary_name": "python-glance-doc",
"binary_version": "1:2014.1-0ubuntu1"
}
],
"availability": "No subscription required"
}