NVD Vulnerability Detail

CVE-2013-4428

Summary	OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and Havana before 2013.2, when the download_image policy is configured, does not properly restrict access to cached images, which allows remote authenticated users to read otherwise restricted images via an image UUID.
Publication Date	Oct. 27, 2013, 9:55 a.m.
Registration Date	Jan. 26, 2021, 3:43 p.m.
Last Update	Nov. 21, 2024, 10:55 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:openstack:glance::::::::	2012.2	2012.2.4
cpe:2.3:a:openstack:glance::::::::	2013.1			2013.1.4
cpe:2.3:a:openstack:glance:2013.2:milestone1::::::
cpe:2.3:a:openstack:glance:2013.2:milestone2::::::
cpe:2.3:a:openstack:glance:2013.2:milestone3::::::

Related information, measures and tools

No	URL	タグ
1	http://rhn.redhat.com/errata/RHSA-2013-1525.html	Third Party Advisory
2	http://rhn.redhat.com/errata/RHSA-2013-1525.html	Third Party Advisory
3	http://www.openwall.com/lists/oss-security/2013/10/15/8	Mailing List Third Party Advisory
4	http://www.openwall.com/lists/oss-security/2013/10/15/8	Mailing List Third Party Advisory
5	http://www.openwall.com/lists/oss-security/2013/10/16/9	Mailing List Third Party Advisory
6	http://www.openwall.com/lists/oss-security/2013/10/16/9	Mailing List Third Party Advisory
7	http://www.securityfocus.com/bid/63159	Third Party Advisory VDB Entry
8	http://www.securityfocus.com/bid/63159	Third Party Advisory VDB Entry
9	http://www.ubuntu.com/usn/USN-2003-1	Third Party Advisory
10	http://www.ubuntu.com/usn/USN-2003-1	Third Party Advisory
11	https://bugs.launchpad.net/glance/+bug/1235226	Exploit Third Party Advisory
12	https://bugs.launchpad.net/glance/+bug/1235226	Exploit Third Party Advisory
13	https://bugs.launchpad.net/glance/+bug/1235378	Exploit Third Party Advisory
14	https://bugs.launchpad.net/glance/+bug/1235378	Exploit Third Party Advisory
15	https://launchpad.net/glance/+milestone/2013.1.4	Patch Third Party Advisory
16	https://launchpad.net/glance/+milestone/2013.1.4	Patch Third Party Advisory
17	https://launchpad.net/glance/+milestone/2013.2	Patch Third Party Advisory
18	https://launchpad.net/glance/+milestone/2013.2	Patch Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

JVN Vulnerability Information

複数の OpenStack 製品における制限イメージを読まれる脆弱性

Title	複数の OpenStack 製品における制限イメージを読まれる脆弱性
Summary	OpenStack Image Registry and Delivery Service (Glance) の Folsom、Grizzly、および Havana は、image_download ポリシーが設定されている場合、キャッシュされたイメージへのアクセスを適切に制限しないため、他の制限イメージを読まれる脆弱性が存在します。
Possible impacts	リモート認証されたユーザにより、イメージの UUID を介して、他の制限イメージを読まれる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 17, 2013, midnight
Registration Date	Dec. 3, 2013, 3:56 p.m.
Last Update	Jan. 17, 2014, 11:29 a.m.

Affected System

OpenStack

OpenStack Compute Folsom

OpenStack Grizzly 2013.1.4 未満

OpenStack Havana 2013.2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-4428	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4428
National Vulnerability Database (NVD)
2	CVE-2013-4428	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4428

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
Debian Bug report logs
1	726478	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=726478
Launchpad
2	Bug #1235226	https://bugs.launchpad.net/glance/+bug/1235226
3	Bug #1235378	https://bugs.launchpad.net/glance/+bug/1235378
4	Glance 2013.1.4	https://launchpad.net/glance/+milestone/2013.1.4
5	Glance 2013.2 "havana"	https://launchpad.net/glance/+milestone/2013.2
Red Hat Security Advisory
6	RHSA-2013:1525	http://rhn.redhat.com/errata/RHSA-2013-1525.html
Ubuntu Security Notice
7	USN-2003-1	http://www.ubuntu.com/usn/USN-2003-1

Change Log

No	Changed Details	Date of change
0	[2013年12月03日] 掲載 [2014年01月17日] ベンダ情報：Debian (726478) を追加ベンダ情報：レッドハット (RHSA-2013:1525) を追加	Feb. 17, 2018, 10:37 a.m.