An SSRF issue was discovered in OpenStack Glance before Newton.
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 9 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.
Summary
An SSRF issue was discovered in OpenStack Glance before Newton. The 'copy_from' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to enumerate internal network details while appearing masked, since the scan would appear to originate from the Glance Image service.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | glance (PyPI) | before 11.0.0a0 | 11.0.0a0 | Patch available | GHSA-j6mr-cm6x-h6jg |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- glance (PyPI) Vendor— Affected before 11.0.0a0 Fixed in 11.0.0a0 Patch available GHSA-j6mr-cm6x-h6jg
Remediation
- Fix · GHSA-j6mr-cm6x-h6jg glance (PyPI) Fixed in 11.0.0a0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux OpenStack Platform 6 (Juno) | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 17.1 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 8 (Liberty) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 9 (Mitaka) | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-7200
- 2026-10-03 Alias added: GHSA-j6mr-cm6x-h6jg
- 2026-10-07 Affected versions changed · Red Hat
References
Advisory 4
More OpenStack Glance vulnerabilities
- TI-2022-23762 An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and… CVSS 3.1MEDIUM 5.7
- TI-2026-27114 Server-side request forgery in OpenStack Glance CVSS 3.1MEDIUM 5.0
- TI-2015-04330 The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1… CVSS 3.0HIGH 7.5
- TI-2016-07073 Uncontrolled resource consumption in openstack-glance CVSS 3.0MEDIUM 6.5
- TI-2013-01623 Openstack glance: swift: s3: openstack glance: information disclosure of backend credentials via cached image request CVSS 3.1MEDIUM 6.5
- TI-2024-21386 An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and… CVSS 3.1MEDIUM 6.5
Sources
- CVE-2017-7200 · CVE Program
- CVE-2017-7200 · NVD
- FIRST EPSS
- GHSA-j6mr-cm6x-h6jg · GitHub Advisory Database · CC BY 4.0
- CVE-2017-7200 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences