USN-8111-1
glance vulnerability
It was discovered that OpenStack Glance was incorrectly validating the IP addresses and the redirect destination URL when downloading or importing images from a remote source. An attacker could possibly use this issue to perform server-side request forgery and obtain sensitive information.
What each source reports
OSV No score
glance vulnerability
It was discovered that OpenStack Glance was incorrectly validating the IP addresses and the redirect destination URL when downloading or importing images from a remote source. An attacker could possibly use this issue to perform server-side request forgery and obtain sensitive information.
- Record
USN-8111-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
glanceUbuntu:22.04:LTS |
before 2:24.2.1-0ubuntu1.4, plus listed versions 2:23.0.0-0ubuntu12:23.0.0+git2021120811.4ee7799aa-0ubuntu12:23.0.0+git2022011216.502fa0ffc-0ubuntu12:24.0.0~rc1+git2022030311.d4119be05-0ubuntu12:24.0.0-0ubuntu1 Show 5 moreShow less2:24.1.0-0ubuntu12:24.1.0-0ubuntu1.12:24.2.0-0ubuntu12:24.2.1-0ubuntu12:24.2.1-0ubuntu1.2 |
2:24.2.1-0ubuntu1.4 |
glanceUbuntu:24.04:LTS |
before 2:28.1.0-0ubuntu1.2, plus listed versions 2:27.0.0-0ubuntu12:28.0.0~b2+git2024011916.f429b53e-0ubuntu12:28.0.0~rc1-0ubuntu12:28.0.1-0ubuntu12:28.0.1-0ubuntu1.22:28.1.0-0ubuntu1 |
2:28.1.0-0ubuntu1.2 |
glanceUbuntu:25.10 |
before 2:31.0.0-0ubuntu1.2, plus listed versions 2:30.0.0-0ubuntu12:30.0.0+git2025070714.9b2cd1634-0ubuntu12:31.0.0~rc1-0ubuntu12:31.0.0-0ubuntu1 |
2:31.0.0-0ubuntu1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-8111-1 is a vulnerability with no CVSS score yet in glance, published March 19, 2026. No source lists public exploit code. Fixed in glance 2:24.2.1-0ubuntu1.4.