Read the docs
TI-2015-04330 Aliases CVE-2015-5162GHSA-g2j5-7vgx-6xrx

The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1…

Priority LOW 38CWE-399Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 6 fixed, 2 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-399 and the CVSS impact.

Summary

The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.

Why it matters now

EPSS 0.03088 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial cinder (PyPI): 7.0.2, 9.0.0glance (PyPI): 14.0.0+1 more productRed Hat: 6 advisoriesRed Hat: 6 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—cinder (PyPI)before 7.0.27.0.2Patch availableGHSA-g2j5-7vgx-6xrx
—cinder (PyPI)8.0.0 to before 9.0.09.0.0Patch availableGHSA-g2j5-7vgx-6xrx
—glance (PyPI)before 14.0.014.0.0Patch availableGHSA-g2j5-7vgx-6xrx
—nova (PyPI)before 12.0.412.0.4Patch availableGHSA-g2j5-7vgx-6xrx
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • cinder (PyPI) Vendor— Affected before 7.0.2 Fixed in 7.0.2 Patch available GHSA-g2j5-7vgx-6xrx
  • cinder (PyPI) Vendor— Affected 8.0.0 to before 9.0.0 Fixed in 9.0.0 Patch available GHSA-g2j5-7vgx-6xrx
  • glance (PyPI) Vendor— Affected before 14.0.0 Fixed in 14.0.0 Patch available GHSA-g2j5-7vgx-6xrx
  • nova (PyPI) Vendor— Affected before 12.0.4 Fixed in 12.0.4 Patch available GHSA-g2j5-7vgx-6xrx

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:openstack:cinder:7.0.2:*:*:*:*:*:*:*7.0.2VulnerableOpenStack
cpe:2.3:a:openstack:cinder:8.0.0:*:*:*:*:*:*:*8.0.0VulnerableOpenStack
cpe:2.3:a:openstack:cinder:8.1.0:*:*:*:*:*:*:*8.1.0VulnerableOpenStack
cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*up to 11.0.0VulnerableOpenStack
cpe:2.3:a:openstack:glance:11.0.1:*:*:*:*:*:*:*11.0.1VulnerableOpenStack
cpe:2.3:a:openstack:glance:12.0.0:*:*:*:*:*:*:*12.0.0VulnerableOpenStack
cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*up to 12.0.3VulnerableOpenStack
cpe:2.3:a:openstack:nova:13.0.0:*:*:*:*:*:*:*13.0.0VulnerableOpenStack
  • cpe:2.3:a:openstack:cinder:7.0.2:*:*:*:*:*:*:* Versions 7.0.2 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:cinder:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:cinder:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:* Versions up to 11.0.0 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:glance:11.0.1:*:*:*:*:*:*:* Versions 11.0.1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:glance:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:* Versions up to 12.0.3 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:nova:13.0.0:*:*:*:*:*:*:* Versions 13.0.0 Vulnerable ·OpenStack

Remediation

  • Fix · GHSA-g2j5-7vgx-6xrx cinder (PyPI) Fixed in 7.0.2 Advisory →
  • Fix · GHSA-g2j5-7vgx-6xrx cinder (PyPI) Fixed in 9.0.0 Advisory →
  • Fix · GHSA-g2j5-7vgx-6xrx glance (PyPI) Fixed in 14.0.0 Advisory →
  • Fix · GHSA-g2j5-7vgx-6xrx nova (PyPI) Fixed in 12.0.4 Advisory →

Red Hat 6 advisories

  • RHSA-2017:0282 Released 2017-02-15 · Red Hat rating Moderate
    openstack-cinder, openstack-glance, and openstack-nova security update
    • Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 openstack-cinder-2015.1.3-12.el7ost, openstack-cinder-doc-2015.1.3-12.el7ost, openstack-glance-2015.1.2-3.el7ost +21
  • RHSA-2017:0165 Released 2017-01-19 · Red Hat rating Moderate
    openstack-cinder security update
    • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 openstack-cinder-2014.1.5-9.el6ost, openstack-cinder-doc-2014.1.5-9.el6ost, python-cinder-2014.1.5-9.el6ost
  • RHSA-2017:0153 Released 2017-01-19 · Red Hat rating Moderate
    openstack-cinder security update
    • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 openstack-cinder-2014.1.5-9.el7ost, openstack-cinder-doc-2014.1.5-9.el7ost, python-cinder-2014.1.5-9.el7ost
Show 3 more Red Hat advisories
  • RHSA-2017:0156 Released 2017-01-19 · Red Hat rating Moderate
    openstack-cinder security update
    • Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 openstack-cinder-2014.2.4-11.el7ost, openstack-cinder-doc-2014.2.4-11.el7ost, python-cinder-2014.2.4-11.el7ost
  • RHSA-2016:2991 Released 2016-12-21 · Red Hat rating Moderate
    openstack-cinder, openstack-glance, and openstack-nova update
    • Red Hat OpenStack Platform 8.0 (Liberty) openstack-cinder-1:7.0.3-1.el7ost, openstack-glance-1:11.0.1-6.el7ost, openstack-nova-1:12.0.5-9.el7ost +16
  • RHSA-2016:2923 Released 2016-12-07 · Red Hat rating Moderate
    openstack-cinder and openstack-glance security update
    • Red Hat OpenStack Platform 9.0 openstack-cinder-1:8.1.1-4.el7ost, openstack-glance-1:12.0.0-2.el7ost, python-cinder-1:8.1.1-4.el7ost +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux OpenStack Platform 6 (Juno)AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6Fixed RHSA-2017:0165
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7Fixed RHSA-2017:0153
Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7Fixed RHSA-2017:0156
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7Fixed RHSA-2017:0282
Red Hat OpenStack Platform 8.0 (Liberty)Fixed RHSA-2016:2991
Red Hat OpenStack Platform 9.0Fixed RHSA-2016:2923
Not affected: 4 products
  • Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)
  • Red Hat Enterprise Linux OpenStack Platform 6 (Juno)
  • Red Hat OpenStack Platform 10 (Newton)
  • Red Hat OpenStack Platform 9 (Mitaka)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-5162
  2. 2026-10-03 Alias added: GHSA-g2j5-7vgx-6xrx

References

Exploit 1

Advisory 8

Other 5

  • TI-2022-23762 An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and… CVSS 3.1MEDIUM 5.7
  • TI-2017-11109 Information disclosure in openstack-cinder CVSS 3.1HIGH 7.5
  • TI-2024-21386 An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and… CVSS 3.1MEDIUM 6.5
  • TI-2013-03674 The (1) backup (api/contrib/backups.py) and (2) volume transfer… CVSS 2.0MEDIUM 4.3
  • TI-2014-02962 The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows… CVSS 2.0MEDIUM 4.0
  • TI-2014-06020 The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova… CVSS 2.0LOW 2.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences