Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

glance

22 known vulnerabilities (4 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
22 · 4 medium, 1 low
Registry
PyPI

Advisories 22

  • CVE-2026-34881Medium 5.0

    OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF).

    Affected: fixed in 29.2.0; from 30.0.0, fixed in 30.2.0; from 31.0.0, fixed in 31.1.0; fixed in 29.2.0; from 30.0.0, fixed in 30.2.0; from 31.0.0, fixed in 31.1.0.

  • CVE-2024-32498Medium 6.5

    An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3.

    Affected: through 28.0.1.

  • A flaw was found in openstack-glance.

    Affected: through 25.1.0.

  • CVE-2022-47951Medium 5.7

    An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and…

    Affected: fixed in 23.0.1; from 24.0.0, fixed in 24.1.1; fixed in 23.0.1; from 24.0.0, fixed in 24.1.1.

  • The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a…

    Affected: through 11.0.0.

  • An SSRF issue was discovered in OpenStack Glance before Newton.

    Affected: fixed in 11.0.0a0.

  • The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0…

    Affected: fixed in 14.0.0.

  • OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow…

    Affected: from 11.0.0, fixed in 11.0.2.

  • OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass…

    Affected: fixed in 2014.2.4; from 2015.1.0, fixed in 2015.1.2; fixed in 2014.2.4; from 2015.1.0, fixed in 2015.1.2.

  • OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the…

    Affected: from 2011.2, fixed in 2014.2.4; from 2015.1.0, fixed in 2015.1.2; from 2011.2, fixed in 2014.2.4; from 2015.1.0, fixed in 2015.1.2.

  • The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote…

    Affected: from 2015.1.0, fixed in 2015.1.2.

  • OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote…

    Affected: fixed in 11.0.0a0.

  • OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote…

    Affected: fixed in 11.0.0a0.

  • OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quota and cause…

    Affected: fixed in 11.0.0a0.

  • The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote…

    Affected: fixed in 11.0.0a0.

Show all 22 advisoriesShow fewer advisories

  • OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2…

    Affected: fixed in 11.0.0a0.

  • The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2…

    Affected: from 2013.2, fixed in 2013.2.4.

  • OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the…

    Affected: fixed in 11.0.0a0.

  • CVE-2013-1840Medium 6.5

    Openstack glance: swift: s3: openstack glance: information disclosure of backend credentials via cached image request

    Affected: fixed in 11.0.0a0; through v1.

  • store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs…

    Affected: from 2012.1, fixed in 2012.2.3.

  • The v2 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary…

    Affected: fixed in 11.0.0a0.

  • The v1 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary…

    Affected: fixed in 11.0.0a0.