Openstack glance: swift: s3: openstack glance: information disclosure of backend credentials via cached image request
Priority LOW 32CWE-201Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-201.
Summary
A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the disclosure of the operator's backend credentials.
Why it matters now
EPSS 0.01702 77th percentileScored 2026-11-07
Fix Fixed glance (PyPI): 11.0.0a0Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | OpenStack Folsom for RHEL 6 | — | 2012.2.3-8.el6ost | Patch available | CNA |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenStack Platform 17.1 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenStack Platform 18.0 | — | — | Not affected | CNA |
| — | glance (PyPI) | before 11.0.0a0 | 11.0.0a0 | Patch available | GHSA-c8w9-83vg-r8vv |
- OpenStack Folsom for RHEL 6 VendorRed Hat Affected — Fixed in 2012.2.3-8.el6ost Patch available CNA
- Red Hat OpenStack Platform 16.2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenStack Platform 17.1 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenStack Platform 18.0 VendorRed Hat Affected — Fixed in — Not affected CNA
- glance (PyPI) Vendor— Affected before 11.0.0a0 Fixed in 11.0.0a0 Patch available GHSA-c8w9-83vg-r8vv
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openstack:glance:v1:*:*:*:*:*:*:* | v1 | Vulnerable | OpenStack |
| cpe:2.3:a:openstack:essex:2012.1:*:*:*:*:*:*:* | 2012.1 | Running on | OpenStack |
| cpe:2.3:a:openstack:folsom:2012.2:*:*:*:*:*:*:* | 2012.2 | Running on | OpenStack |
| cpe:2.3:a:amazon:s3_store:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AWS |
| cpe:2.3:a:openstack:swift:-:*:*:*:*:*:*:* | not specified by NVD | Running on | OpenStack |
- cpe:2.3:a:openstack:glance:v1:*:*:*:*:*:*:* Versions v1 Vulnerable ·OpenStack
- cpe:2.3:a:openstack:essex:2012.1:*:*:*:*:*:*:* Versions 2012.1 Running on ·OpenStack
- cpe:2.3:a:openstack:folsom:2012.2:*:*:*:*:*:*:* Versions 2012.2 Running on ·OpenStack
- cpe:2.3:a:amazon:s3_store:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AWS
- cpe:2.3:a:openstack:swift:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·OpenStack
Remediation
- Fix · GHSA-c8w9-83vg-r8vv glance (PyPI) Fixed in 11.0.0a0 Advisory →
Red Hat 1 advisory
- RHSA-2013:0707 Released 2013-04-04 · Red Hat rating Moderateopenstack-glance security and bug fix update
- OpenStack Folsom openstack-glance-2012.2.3-8.el6ost, openstack-glance-doc-2012.2.3-8.el6ost, python-glance-2012.2.3-8.el6ost
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenStack Folsom | Fixed | RHSA-2013:0707 |
Not affected: 3 products
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0
Timeline
- 2026-10-02 Threatist record created from CVE-2013-1840
- 2026-10-03 Alias added: GHSA-c8w9-83vg-r8vv
- 2026-10-30 Title updated · CNA
- 2026-10-30 CVSS score added · CNA
- 2026-10-30 Weakness changed · CNA
- 2026-10-30 Fix available: openstack-glance@0:2012.2.3-8.el6ost · CNA
- 2026-10-30 2 new references · CNA
- 2026-10-30 Fix available: OpenStack Folsom · Red Hat
References
Other 17
- http://osvdb.org/91304
- http://rhn.redhat.com/errata/RHSA-2013-0707.html
- http://www.openwall.com/lists/oss-security/2013/03/14/15
- http://www.ubuntu.com/usn/USN-1764-1
- https://access.redhat.com/security/cve/CVE-2013-1840
- https://bugs.launchpad.net/glance/+bug/1135541
- https://review.openstack.org/#/c/24437/
- https://review.openstack.org/#/c/24438/
- https://review.openstack.org/#/c/24439/
- https://github.com/openstack/glance/commit/74b067df9726f9cf3e6e17e248719794a6ee0745
- https://github.com/openstack/glance/commit/dd849a9be540bedd4fd904cc0b86ccd9c3e34af2
- https://github.com/openstack/glance/commit/e75764eee34915f8bc5b664ac18e47a556c9d3dd
- https://github.com/openstack/glance
- https://github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2013-46.yaml
- https://review.openstack.org/#/c/24437
- https://review.openstack.org/#/c/24438
- https://review.openstack.org/#/c/24439
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2013-1840 · CVE Program
- CVE-2013-1840 · NVD
- FIRST EPSS
- GHSA-c8w9-83vg-r8vv · GitHub Advisory Database · CC BY 4.0
- CVE-2013-1840 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences