High severity · published Oct 7, 2016
CVE-2015-5162
The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls,…
7.5
CVSS
3.1%
EPSS
No
On KEV
Description
The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
Cinder · Openstack
7.0.2; 8.0.0; 8.1.0 · source: NVD
GL
Glance · Openstack
through 11.0.0; 11.0.1; 12.0.0 · source: NVD
NO
Nova · Openstack
through 12.0.3; 13.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5162
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5162
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2016-2923.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2016-2991.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2017-0153.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2017-0156.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2017-0165.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2017-0282.html
More from Cinder
7.5
CVE-2017-15139
A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data
6.5
CVE-2024-32498
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3
5.7
CVE-2022-47951
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x…
4.3
CVE-2026-93856
In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API
–
CVE-2014-7231
The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when…