CVE-2016-0757

Impact:
Low
Public Date:
2016-02-04
CWE:
CWE-285
Bugzilla:
1302607: CVE-2016-0757 openstack-glance: Glance image status manipulation through locations
An authorization vulnerability in OpenStack Image service was discovered, which allowed image-status manipulation using locations. By removing the last location of an image, an authenticated user could change the status from 'active' to 'queue'. A malicious tenant could exploit this flaw to silently replace owned image data, regardless of its original creator or visibility settings. Only environments with show_multiple_locations set to true (not default) were affected.

Find out more about CVE-2016-0757 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v2 metrics

Base Score 3.5
Base Metrics AV:N/AC:M/Au:S/C:N/I:P/A:N
Access Vector Network
Access Complexity Medium
Authentication Single
Confidentiality Impact None
Integrity Impact Partial
Availability Impact None

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 (openstack-glance) RHSA-2016:0352 2016-03-03
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 (openstack-glance) RHSA-2016:0358 2016-03-07
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 (openstack-glance) RHSA-2016:0354 2016-03-03
Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 (openstack-glance) RHSA-2016:0309 2016-02-29

Affected Packages State

Platform Package State
Red Hat OpenStack Platform 8.0 (Liberty) openstack-glance Not affected

Acknowledgements

Red Hat would like to thank the Openstack project for reporting this issue. Upstream acknowledges Erno Kuvaja (HPE) as the original reporter.

Last Modified
Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.