Stuart Mclaren

**Name of the Vulnerable Software and Affected Versions** OpenStack Image Registry and Delivery Service (Glance) versions prior to 2013.2.4 OpenStack Image Registry and Delivery Service (Glance) versions 2014.x prior to 2014.1.3 OpenStack Image Registry and Delivery Service (Glance) versions prior to Juno-3 **Description** The issue allows remote authenticated users to cause a denial of service by consuming disk space through uploading large images, due to the improper enforcement of the `image size cap` configuration option when using the V2 API. **Recommendations** For versions prior to 2013.2.4, update to version 2013.2.4 or later to resolve the issue. For versions 2014.x prior to 2014.1.3, update to version 2014.1.3 or later to resolve the issue. For versions prior to Juno-3, update to Juno-3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** OpenStack Image Registry and Delivery Service (Glance) versions Folsom through Grizzly before 2013.1.4 OpenStack Image Registry and Delivery Service (Glance) version Havana before 2013.2 **Description** The issue allows remote authenticated users to read otherwise restricted images via an image UUID, due to improper access restriction to cached images when the download image policy is configured. **Recommendations** For OpenStack Image Registry and Delivery Service (Glance) versions Folsom through Grizzly before 2013.1.4, update to version 2013.1.4 or later. For OpenStack Image Registry and Delivery Service (Glance) version Havana before 2013.2, update to version 2013.2 or later.

**Name of the Vulnerable Software and Affected Versions** OpenStack Glance versions 2012.1 through 2012.2, Grizzly **Description** The issue in OpenStack Glance allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image when using the single-tenant Swift or S3 store. This occurs because the v1 API reports the location field. **Recommendations** For OpenStack Glance versions 2012.1 through 2012.2, consider restricting access to the v1 API until a fix is available. For OpenStack Glance Grizzly, avoid using the single-tenant Swift or S3 store with the v1 API until the issue is resolved. As a temporary workaround, consider disabling the use of the location field in the v1 API for cached images.