Unscored severity · published Feb 24, 2015
CVE-2014-9684
OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of…
–
CVSS
2%
EPSS
No
On KEV
Description
OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IR
Image Registry And Delivery Service (glance) · Openstack
2014.2; 2014.2.1; 2014.2.2 · source: NVD
Affected product
IR
Image Registry And Delivery Service (glance)
Openstack
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-9684
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-9684
Vendor Advisory
http://lists.openstack.org/pipermail/openstack-announce/2015-February/000336.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-0938.html
www.securityfocus.com
http://www.securityfocus.com/bid/72692
Exploit
https://bugs.launchpad.net/glance/+bug/1371118
More from Image Registry And Delivery Service (glance)
4.3
CVE-2016-0757
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change…
–
CVE-2015-5286
OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of…
–
CVE-2015-5251
OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access…
–
CVE-2015-1881
OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of…
–
CVE-2014-9623
OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by…