Homepage

glance@25.0.0.0rc1

OpenStack Image Service

  • latest version

    32.0.0

  • first published

    7 years ago

  • latest version published

    5 months ago

  • licenses detected

  • View glance package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the glance package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Server-side Request Forgery (SSRF)

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to the use of HTTP redirects. An attacker can access internal services by leveraging HTTP redirects to bypass URL validation checks. This is only exploitable if the web-download, glance-download import methods, or the optional ovf_process image import plugin are enabled.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade glance to version 29.2.0, 30.2.0, 31.1.0 or higher.

    [,29.2.0)[30.0.0,30.2.0)[31.0.0,31.1.0)
    • C
    Improper Input Validation

    Affected versions of this package are vulnerable to Improper Input Validation in QCOW2 image processing. An authenticated user may convince systems to return a copy of that file's contents from the server resulting in unauthorized access to potentially sensitive data and unbounded memory/CPU consumption.

    Note: All Cinder deployments are affected; only Glance deployments with image conversion enabled are affected; all Nova deployments are affected.

    How to fix Improper Input Validation?

    Upgrade glance to version 26.1.0, 27.1.0, 28.1.0 or higher.

    [,26.1.0)[27.0.0,27.1.0)[28.0.0,28.1.0)
    • M
    Unsafe Dependency Resolution

    Affected versions of this package are vulnerable to Unsafe Dependency Resolution by allowing a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images.

    How to fix Unsafe Dependency Resolution?

    There is no fixed version for glance.

    [0,)
    • M
    Information Exposure

    Affected versions of this package are vulnerable to Information Exposure when supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.

    How to fix Information Exposure?

    Upgrade glance to version 26.0.0 or higher.

    [,26.0.0)
    Go back to all versions of this package