Security update for openstack-glance SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:0101-1 Final 1 1 2016-01-13T12:31:46Z current 2016-01-13T12:31:46Z 2016-01-13T12:31:46Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openstack-glance This update for openstack-glance provides the following fixes: - Catch NotAuthenticated exception in import task. (bsc#947735, CVE-2015-5286) - Cleanup chunks for deleted image if token expired. (bsc#947735, CVE-2015-5286) - Prevent image status being directly modified via v1. (bsc#945994, CVE-2015-5251) - Fix error when downloading image status is not active. (bsc#945051) - Add ability to deactivate an image. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleclo50sp3-openstack-glance-12321 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20160101-1/ Link for SUSE-SU-2016:0101-1 https://lists.suse.com/pipermail/sle-security-updates/2016-January/001795.html E-Mail link for SUSE-SU-2016:0101-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/945051 SUSE Bug 945051 https://bugzilla.suse.com/945994 SUSE Bug 945994 https://bugzilla.suse.com/947735 SUSE Bug 947735 https://www.suse.com/security/cve/CVE-2015-5251/ SUSE CVE CVE-2015-5251 page https://www.suse.com/security/cve/CVE-2015-5286/ SUSE CVE CVE-2015-5286 page SUSE OpenStack Cloud 5 openstack-glance-2014.2.4.juno-14.1 openstack-glance-doc-2014.2.4.juno-14.1 python-glance-2014.2.4.juno-14.1 openstack-glance-2014.2.4.juno-14.1 as a component of SUSE OpenStack Cloud 5 openstack-glance-doc-2014.2.4.juno-14.1 as a component of SUSE OpenStack Cloud 5 python-glance-2014.2.4.juno-14.1 as a component of SUSE OpenStack Cloud 5 OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*. CVE-2015-5251 SUSE OpenStack Cloud 5:openstack-glance-2014.2.4.juno-14.1 SUSE OpenStack Cloud 5:openstack-glance-doc-2014.2.4.juno-14.1 SUSE OpenStack Cloud 5:python-glance-2014.2.4.juno-14.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160101-1/ https://www.suse.com/security/cve/CVE-2015-5251.html CVE-2015-5251 https://bugzilla.suse.com/945994 SUSE Bug 945994 OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. CVE-2015-5286 SUSE OpenStack Cloud 5:openstack-glance-2014.2.4.juno-14.1 SUSE OpenStack Cloud 5:openstack-glance-doc-2014.2.4.juno-14.1 SUSE OpenStack Cloud 5:python-glance-2014.2.4.juno-14.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160101-1/ https://www.suse.com/security/cve/CVE-2015-5286.html CVE-2015-5286 https://bugzilla.suse.com/947735 SUSE Bug 947735