Every CVE Search/ Get API key

CVE-2015-5286

OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service

6.8 MediumFix available

CVE-2015-5286 is a medium vulnerability (CVSS 6.8) in Openstack Image Registry And Delivery Service \(glance\), published October 26, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.40%, the 83rd percentile. Fixed in glance 2014.2.4.

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.

Exploit likelihood

2.40%Up 1.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.8

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.

Record
CVE-2015-5286
CVSS 2.0
6.8 MediumAV:N/AC:L/Au:S/C:N/I:N/A:C
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.

Record
CVE-2015-5286
Updated
2026-11-02
EUVDEUVD-2022-4019 No score

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.

Record
EUVD-2022-4019
Updated
2026-11-03
GitHub AdvisoriesGHSA-gvjg-r9fv-7qx9 No score

OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.

Record
GHSA-gvjg-r9fv-7qx9
Weakness
CWE-400
Updated
2026-11-02
OSV No score

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.

Record
CVE-2015-5286
Updated
2026-11-02
OSVDEBIAN-CVE-2015-5286 No score

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.

Record
DEBIAN-CVE-2015-5286
Updated
2026-11-02
Show 5 moreShow less
OSVGHSA-gvjg-r9fv-7qx9 No score

OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.

Record
GHSA-gvjg-r9fv-7qx9
Weakness
CWE-400
Updated
2026-11-02
OSVPYSEC-2026-812 No score

OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.

Record
PYSEC-2026-812
Updated
2026-11-02
OSVSUSE-SU-2016:0101-1 No score

Security update for openstack-glance

This update for openstack-glance provides the following fixes:

  • Catch NotAuthenticated exception in import task. (bsc#947735, CVE-2015-5286)
  • Cleanup chunks for deleted image if token expired. (bsc#947735, CVE-2015-5286)
  • Prevent image status being directly modified via v1. (bsc#945994, CVE-2015-5251)
  • Fix error when downloading image status is not active. (bsc#945051)
  • Add ability to deactivate an image.
Record
SUSE-SU-2016:0101-1
Updated
2026-11-02
OSVUBUNTU-CVE-2015-5286 No score

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.

Record
UBUNTU-CVE-2015-5286
Updated
2026-11-02
OSVUSN-3446-1 No score

glance vulnerabilities

Hemanth Makkapati discovered that OpenStack Glance incorrectly handled access restrictions. A remote authenticated user could use this issue to change the status of images, contrary to access restrictions. (CVE-2015-5251)

Mike Fedosin and Alexei Galkin discovered that OpenStack Glance incorrectly handled the storage quota. A remote authenticated user could use this issue to consume disk resources, leading to a denial of service. (CVE-2015-5286)

Erno Kuvaja discovered that OpenStack Glance incorrectly handled the show_multiple_locations option. When show_multiple_locations is enabled, a remote authenticated user could change an image status and upload new image data. (CVE-2016-0757)

Record
USN-3446-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
glance
PyPI
 before 2014.2.4
2014.2.4
glance
PyPI
 2015.1.0 up to 2015.1.2
2015.1.2
glance
Debian:12
 before 1:11.0.0-1
1:11.0.0-1
glance
Debian:13
 before 1:11.0.0-1
1:11.0.0-1
glance
Debian:14
 before 1:11.0.0-1
1:11.0.0-1
glance
PyPI
 before 2014.2.4, plus listed versions
15.0.217.0.118.0.018.0.0.0b118.0.0.0rc1
Show 45 moreShow less
18.0.119.0.019.0.0.0b119.0.0.0rc119.0.0.0rc219.0.119.0.219.0.319.0.420.0.020.0.0.0b120.0.0.0b220.0.0.0b320.0.0.0rc120.0.0.0rc220.0.120.1.020.2.021.0.021.0.0.0b121.0.0.0b221.0.0.0rc121.0.0.0rc221.1.022.0.022.0.0.0b222.0.0.0b322.0.0.0rc122.1.022.1.123.0.023.0.0.0b223.0.0.0b323.0.0.0rc123.0.0.0rc223.1.024.0.024.0.0.0rc124.1.024.2.024.2.125.0.025.0.0.0b225.0.0.0b325.0.0.0rc1
2014.2.4
glance
PyPI
 before 2014.2.4, 2015.1.0 up to 2015.1.2, plus listed versions
15.0.217.0.118.0.018.0.0.0b118.0.0.0rc1
Show 45 moreShow less
18.0.119.0.019.0.0.0b119.0.0.0rc119.0.0.0rc219.0.119.0.219.0.319.0.420.0.020.0.0.0b120.0.0.0b220.0.0.0b320.0.0.0rc120.0.0.0rc220.0.120.1.020.2.021.0.021.0.0.0b121.0.0.0b221.0.0.0rc121.0.0.0rc221.1.022.0.022.0.0.0b222.0.0.0b322.0.0.0rc122.1.022.1.123.0.023.0.0.0b223.0.0.0b323.0.0.0rc123.0.0.0rc223.1.024.0.024.0.0.0rc124.1.024.2.024.2.125.0.025.0.0.0b225.0.0.0b325.0.0.0rc1
2014.2.42015.1.2
openstack-glance
Red Hat:openstack:5::el6
 before 0:2014.1.5-3.el6ost
0:2014.1.5-3.el6ost
openstack-glance-doc
Red Hat:openstack:5::el6
 before 0:2014.1.5-3.el6ost
0:2014.1.5-3.el6ost
python-glance
Red Hat:openstack:5::el6
 before 0:2014.1.5-3.el6ost
0:2014.1.5-3.el6ost
Show 12 moreShow less
Affected packages
PackageAffectedFixed
openstack-glance
Red Hat:openstack:5::el7
 before 0:2014.1.5-3.el7ost
0:2014.1.5-3.el7ost
openstack-glance-doc
Red Hat:openstack:5::el7
 before 0:2014.1.5-3.el7ost
0:2014.1.5-3.el7ost
python-glance
Red Hat:openstack:5::el7
 before 0:2014.1.5-3.el7ost
0:2014.1.5-3.el7ost
openstack-glance
Red Hat:openstack:6::el7
 before 0:2014.2.3-3.el7ost
0:2014.2.3-3.el7ost
openstack-glance-doc
Red Hat:openstack:6::el7
 before 0:2014.2.3-3.el7ost
0:2014.2.3-3.el7ost
python-glance
Red Hat:openstack:6::el7
 before 0:2014.2.3-3.el7ost
0:2014.2.3-3.el7ost
openstack-glance
Red Hat:openstack:7::el7
 before 0:2015.1.1-3.el7ost
0:2015.1.1-3.el7ost
openstack-glance-doc
Red Hat:openstack:7::el7
 before 0:2015.1.1-3.el7ost
0:2015.1.1-3.el7ost
python-glance
Red Hat:openstack:7::el7
 before 0:2015.1.1-3.el7ost
0:2015.1.1-3.el7ost
openstack-glance
SUSE:OpenStack Cloud 5
 before 2014.2.4.juno-14.1
2014.2.4.juno-14.1
openstack-glance-doc
SUSE:OpenStack Cloud 5
 before 2014.2.4.juno-14.1
2014.2.4.juno-14.1
glance
Ubuntu:14.04:LTS
 before 1:2014.1.5-0ubuntu1.1, plus listed versions
1:2013.2~rc2-0ubuntu11:2013.2-0ubuntu11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu11:2014.1~b3-0ubuntu2
Show 9 moreShow less
1:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1.1-0ubuntu21:2014.1.2-0ubuntu11:2014.1.2-0ubuntu1.11:2014.1.3-0ubuntu11:2014.1.4-0ubuntu21:2014.1.5-0ubuntu1
1:2014.1.5-0ubuntu1.1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 25 moreShow less
This page doesn't list everything

Left out here: 80 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open