OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2…
Priority LOW 23CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.
Summary
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.
Why it matters now
EPSS 0.01478 74th percentileScored 2026-11-07
Fix Fixed glance (PyPI): 11.0.2Red Hat: 4 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | glance (PyPI) | 11.0.0 to before 11.0.2 | 11.0.2 | Patch available | GHSA-5xrj-ghhp-hx7p |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- glance (PyPI) Vendor— Affected 11.0.0 to before 11.0.2 Fixed in 11.0.2 Patch available GHSA-5xrj-ghhp-hx7p
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):11.0.0:*:*:*:*:*:*:* | 11.0.0 | Vulnerable | OpenStack |
| cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):11.0.1:*:*:*:*:*:*:* | 11.0.1 | Vulnerable | OpenStack |
| cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):2015.1.2:*:*:*:*:*:*:* | 2015.1.2 | Vulnerable | OpenStack |
- cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):11.0.0:*:*:*:*:*:*:* Versions 11.0.0 Vulnerable ·OpenStack
- cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):11.0.1:*:*:*:*:*:*:* Versions 11.0.1 Vulnerable ·OpenStack
- cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):2015.1.2:*:*:*:*:*:*:* Versions 2015.1.2 Vulnerable ·OpenStack
Remediation
- Fix · GHSA-5xrj-ghhp-hx7p glance (PyPI) Fixed in 11.0.2 Advisory →
Red Hat 4 advisories
- RHSA-2016:0358 Released 2016-03-07 · Red Hat rating Lowopenstack-glance security update
- Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 openstack-glance-2014.1.5-5.el6ost, openstack-glance-doc-2014.1.5-5.el6ost, python-glance-2014.1.5-5.el6ost
- RHSA-2016:0354 Released 2016-03-03 · Red Hat rating Lowopenstack-glance security update
- Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 openstack-glance-2014.1.5-5.el7ost, openstack-glance-doc-2014.1.5-5.el7ost, python-glance-2014.1.5-5.el7ost
- RHSA-2016:0352 Released 2016-03-03 · Red Hat rating Lowopenstack-glance security update
- Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 openstack-glance-2015.1.2-2.el7ost, openstack-glance-doc-2015.1.2-2.el7ost, python-glance-2015.1.2-2.el7ost
Show 1 more Red Hat advisories
- RHSA-2016:0309 Released 2016-02-29 · Red Hat rating Lowopenstack-glance security update
- Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 openstack-glance-2014.2.3-4.el7ost, openstack-glance-doc-2014.2.3-4.el7ost, python-glance-2014.2.3-4.el7ost
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 | Fixed | RHSA-2016:0358 |
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 | Fixed | RHSA-2016:0354 |
| Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 | Fixed | RHSA-2016:0309 |
| Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 | Fixed | RHSA-2016:0352 |
Not affected: 1 product
- Red Hat OpenStack Platform 8 (Liberty)
Timeline
- 2026-10-02 Threatist record created from CVE-2016-0757
- 2026-10-03 Alias added: GHSA-5xrj-ghhp-hx7p
References
Other 9
- https://access.redhat.com/errata/RHSA-2016:0309
- https://access.redhat.com/errata/RHSA-2016:0352
- https://access.redhat.com/errata/RHSA-2016:0354
- https://access.redhat.com/errata/RHSA-2016:0358
- https://access.redhat.com/security/cve/CVE-2016-0757
- https://bugzilla.redhat.com/show_bug.cgi?id=1302607
- https://opendev.org/openstack/glance
- https://rhn.redhat.com/errata/RHSA-2016-0309.html
- https://web.archive.org/web/20210123081823/https://www.securityfocus.com/bid/82696
More OpenStack Image Registry And Delivery Service (glance) vulnerabilities
- TI-2015-04442 OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2… CVSS 2.0MEDIUM 6.8
- TI-2015-01076 The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and… CVSS 2.0MEDIUM 6.5
- TI-2014-00156 The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2… CVSS 2.0MEDIUM 6.0
- TI-2012-03913 The v1 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote… CVSS 2.0MEDIUM 5.5
- TI-2014-07716 The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and… CVSS 2.0MEDIUM 5.5
- TI-2012-04601 The v2 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote… CVSS 2.0MEDIUM 5.5
Sources
- CVE-2016-0757 · CVE Program
- CVE-2016-0757 · NVD
- FIRST EPSS
- GHSA-5xrj-ghhp-hx7p · GitHub Advisory Database · CC BY 4.0
- CVE-2016-0757 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences