CVE-2014-9623

Description

OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting an image in the saving state.

How to fix CVE-2014-9623

To remediate CVE-2014-9623, upgrade the affected package to a fixed version below.

• PyPI/glance—upgrade to 11.0.0a0 or later
• PyPI/glance—upgrade to 11.0.0a0 or later

Is CVE-2014-9623 being exploited?

Low — EPSS is 2.8%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 11.0.0a0
• from 0, < 11.0.0a0

References (16)

• ADVISORYgithub.com/advisories/GHSA-j4mh-9wq6-8rg6
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2014-9623
• PATCHgithub.com/openstack/glance
• PATCHpypi.org/project/glance
• WEBrhn.redhat.com/errata/RHSA-2015-0644.html