glance 20.0.0.0rc1 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the glance package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
C Improper Input Validation Affected versions of this package are vulnerable to Improper Input Validation in `QCOW2` image processing. An authenticated user may convince systems to return a copy of that file's contents from the server resulting in unauthorized access to potentially sensitive data and unbounded memory/CPU consumption. Note: All Cinder deployments are affected; only Glance deployments with image conversion enabled are affected; all Nova deployments are affected. How to fix Improper Input Validation? Upgrade `glance` to version 26.1.0, 27.1.0, 28.1.0 or higher.	[,26.1.0)[27.0.0,27.1.0)[28.0.0,28.1.0)
M Unsafe Dependency Resolution Affected versions of this package are vulnerable to Unsafe Dependency Resolution by allowing a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images. How to fix Unsafe Dependency Resolution? There is no fixed version for `glance`.	[0,)
M Information Exposure Affected versions of this package are vulnerable to Information Exposure when supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. How to fix Information Exposure? Upgrade `glance` to version 26.0.0 or higher.	[,26.0.0)

Vulnerability

Vulnerable Version

Improper Input Validation

Affected versions of this package are vulnerable to Improper Input Validation in QCOW2 image processing. An authenticated user may convince systems to return a copy of that file's contents from the server resulting in unauthorized access to potentially sensitive data and unbounded memory/CPU consumption.

Note: All Cinder deployments are affected; only Glance deployments with image conversion enabled are affected; all Nova deployments are affected.

How to fix Improper Input Validation?

Upgrade glance to version 26.1.0, 27.1.0, 28.1.0 or higher.

[,26.1.0)[27.0.0,27.1.0)[28.0.0,28.1.0)

Unsafe Dependency Resolution

Affected versions of this package are vulnerable to Unsafe Dependency Resolution by allowing a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images.

How to fix Unsafe Dependency Resolution?

There is no fixed version for glance.

[0,)

Information Exposure

Affected versions of this package are vulnerable to Information Exposure when supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.

How to fix Information Exposure?

Upgrade glance to version 26.0.0 or higher.

[,26.0.0)

glance@20.0.0.0rc1 vulnerabilities

OpenStack Image Service

latest version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically