CVE-2014-5356

Published: Aug 25, 2014Modified: May 6, 2026

4.0

Vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability: 8.0 / Impact: 2.9

Source: NVD

Description

OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.

Affected (10)

Products: Canonical: Ubuntu Linux · Openstack: Image Registry And Delivery Service (glance)

Canonical

1 product

Ubuntu Linux

Openstack

1 product

Image Registry And Delivery Service (glance)

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Openstack Image Registry And Delivery Service (glance)	Up to 2013.2.3
Openstack Image Registry And Delivery Service (glance)	Version 2013.2.1
Openstack Image Registry And Delivery Service (glance)	Version 2013.2.2
Openstack Image Registry And Delivery Service (glance)	Version 2013.2
Openstack Image Registry And Delivery Service (glance)	Version 2014.1.1
Openstack Image Registry And Delivery Service (glance)	Version 2014.1.2
Openstack Image Registry And Delivery Service (glance)	Version 2014.1
Openstack Image Registry And Delivery Service (glance)	Version juno-1
Openstack Image Registry And Delivery Service (glance)	Version juno-2