GHSA-g2j5-7vgx-6xrxHighCVSS 7.5

OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption

Published
May 14, 2022
Last Modified
February 13, 2023

🔗 CVE IDs covered (1)

CVE-2015-5162 →

📋 Description

The image parser in OpenStack Cinder prior to 7.0.2, and 8.0.0 and above, prior to 9.0.0; Glance prior to 14.00; and Nova prior to 12.0.4 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image. This issue is patched in Cinder 7.0.2 and 9.0.0; Glance 14.0.0; and Nova 12.0.4

🎯 Affected products4

  • pip/cinder:< 7.0.2
  • pip/cinder:>= 8.0.0, < 9.0.0
  • pip/glance:< 14.0.0
  • pip/nova:< 12.0.4

🔗 References (16)