The v2 API in OpenStack Glance Grizzly, Folsom (2012.2), and...

Vulnerability Description

The v2 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protected images via an image deletion request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4573.

References

• http://secunia.com/advisories/51174
• https://github.com/openstack/glance/commit/b591304b8980d8aca8fa6cda9ea1621aca000c88
• http://www.openwall.com/lists/oss-security/2012/11/08/2
• https://bugs.launchpad.net/glance/+bug/1076506
• http://www.securityfocus.com/bid/56437
• https://exchange.xforce.ibmcloud.com/vulnerabilities/80019
• http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092192.html
• http://www.openwall.com/lists/oss-security/2012/11/07/6
• http://www.openwall.com/lists/oss-security/2012/11/09/5
• http://osvdb.org/87248
• https://github.com/openstack/glance/commit/fc0ee7623ec59c87ac6fc671e95a9798d6f2e2c3
• http://www.openwall.com/lists/oss-security/2012/11/09/1
• http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00002.html