{"id":"CVE-2015-5162","aliases":["DEBIAN-CVE-2015-5162","EUVD-2022-3861","GHSA-g2j5-7vgx-6xrx","PYSEC-2026-2412","PYSEC-2026-2491","PYSEC-2026-871","RHSA-2016:2923","RHSA-2016:2991","RHSA-2017:0153","RHSA-2017:0156","RHSA-2017:0165","RHSA-2017:0282","UBUNTU-CVE-2015-5162","USN-3449-1"],"status":"published","title":"OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption","description":"The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03088,"percentile":0.87786,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399","CWE-400"],"published":"2016-10-07T00:00:00Z","modified":"2026-10-31T04:00:05Z","fixes":[{"ecosystem":"PyPI","package":"cinder","fixed_in":["7.0.2","9.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"glance","fixed_in":["14.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"nova","fixed_in":["12.0.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"cinder","fixed_in":["2:8.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cinder","fixed_in":["2:8.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cinder","fixed_in":["2:8.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"glance","fixed_in":["2:12.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"glance","fixed_in":["2:12.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"glance","fixed_in":["2:12.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nova","fixed_in":["2:13.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nova","fixed_in":["2:13.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nova","fixed_in":["2:13.0.0-1"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:9::el7","package":"openstack-cinder","fixed_in":["1:8.1.1-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:9::el7","package":"openstack-glance","fixed_in":["1:12.0.0-2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:9::el7","package":"python-cinder","fixed_in":["1:8.1.1-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:9::el7","package":"python-cinder-tests","fixed_in":["1:8.1.1-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:9::el7","package":"python-glance","fixed_in":["1:12.0.0-2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:9::el7","package":"python-glance-tests","fixed_in":["1:12.0.0-2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"openstack-cinder","fixed_in":["1:7.0.3-1.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"openstack-glance","fixed_in":["1:11.0.1-6.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova","fixed_in":["1:12.0.5-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-api","fixed_in":["1:12.0.5-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-cells","fixed_in":["1:12.0.5-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-cert","fixed_in":["1:12.0.5-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-common","fixed_in":["1:12.0.5-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-compute","fixed_in":["1:12.0.5-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-conductor","fixed_in":["1:12.0.5-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-console","fixed_in":["1:12.0.5-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-network","fixed_in":["1:12.0.5-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-novncproxy","fixed_in":["1:12.0.5-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-objectstore","fixed_in":["1:12.0.5-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-scheduler","fixed_in":["1:12.0.5-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-serialproxy","fixed_in":["1:12.0.5-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-spicehtml5proxy","fixed_in":["1:12.0.5-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"python-cinder","fixed_in":["1:7.0.3-1.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"python-glance","fixed_in":["1:11.0.1-6.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"python-nova","fixed_in":["1:12.0.5-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-cinder","fixed_in":["0:2014.1.5-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-cinder-doc","fixed_in":["0:2014.1.5-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"python-cinder","fixed_in":["0:2014.1.5-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-cinder","fixed_in":["0:2014.2.4-11.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-cinder-doc","fixed_in":["0:2014.2.4-11.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"python-cinder","fixed_in":["0:2014.2.4-11.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-cinder","fixed_in":["0:2014.1.5-9.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-cinder-doc","fixed_in":["0:2014.1.5-9.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"python-cinder","fixed_in":["0:2014.1.5-9.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-cinder","fixed_in":["0:2015.1.3-12.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-cinder-doc","fixed_in":["0:2015.1.3-12.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-glance","fixed_in":["0:2015.1.2-3.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-glance-doc","fixed_in":["0:2015.1.2-3.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova","fixed_in":["0:2015.1.4-32.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-api","fixed_in":["0:2015.1.4-32.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-cells","fixed_in":["0:2015.1.4-32.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-cert","fixed_in":["0:2015.1.4-32.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-common","fixed_in":["0:2015.1.4-32.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-compute","fixed_in":["0:2015.1.4-32.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-conductor","fixed_in":["0:2015.1.4-32.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-console","fixed_in":["0:2015.1.4-32.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-doc","fixed_in":["0:2015.1.4-32.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-network","fixed_in":["0:2015.1.4-32.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-novncproxy","fixed_in":["0:2015.1.4-32.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-objectstore","fixed_in":["0:2015.1.4-32.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-scheduler","fixed_in":["0:2015.1.4-32.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-serialproxy","fixed_in":["0:2015.1.4-32.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-spicehtml5proxy","fixed_in":["0:2015.1.4-32.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"python-cinder","fixed_in":["0:2015.1.3-12.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"python-glance","fixed_in":["0:2015.1.2-3.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"python-nova","fixed_in":["0:2015.1.4-32.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"python-oslo-concurrency","fixed_in":["0:1.8.2-2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"python-oslo-concurrency-doc","fixed_in":["0:1.8.2-2.el7ost"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"nova","fixed_in":["1:2014.1.5-0ubuntu1.7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"9.0.0"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.0"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:13.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:13.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:13.0.0-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"9.0.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2"},{"introduced":"8.0.0"},{"fixed":"9.0.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.1.1-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.0.0-2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"python-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.1.1-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"python-cinder-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.1.1-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"python-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.0.0-2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"python-glance-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.0.0-2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.0.3-1.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.1-6.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.0.5-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.0.5-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-cells","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.0.5-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-cert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.0.5-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.0.5-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-compute","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.0.5-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-conductor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.0.5-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.0.5-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.0.5-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-novncproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.0.5-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-objectstore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.0.5-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-scheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.0.5-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-serialproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.0.5-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"openstack-nova-spicehtml5proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.0.5-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"python-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.0.3-1.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"python-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.1-6.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"python-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.0.5-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-cinder-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.4-11.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-cinder-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.4-11.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"python-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.4-11.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-9.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-cinder-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-9.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"python-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-9.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.3-12.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-cinder-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.3-12.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.2-3.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-glance-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.2-3.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-32.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-32.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-cells","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-32.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-cert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-32.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-32.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-compute","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-32.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-conductor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-32.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-32.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-32.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-32.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-novncproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-32.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-objectstore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-32.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-scheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-32.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-serialproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-32.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-spicehtml5proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-32.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.3-12.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.2-3.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-32.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-oslo-concurrency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.2-2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-oslo-concurrency-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.2-2.el7ost"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2014.1.5-0ubuntu1.7"}]}],"versions":["1:2013.2~rc2-0ubuntu1","1:2013.2-0ubuntu1","1:2014.1~b1-0ubuntu1","1:2014.1~b1-0ubuntu2","1:2014.1~b2-0ubuntu3","1:2014.1~b2-0ubuntu4","1:2014.1~b3-0ubuntu1","1:2014.1~b3-0ubuntu2","1:2014.1~rc1-0ubuntu1","1:2014.1~rc2-0ubuntu1","1:2014.1-0ubuntu1","1:2014.1-0ubuntu1.2","1:2014.1.1-0ubuntu1","1:2014.1.1-0ubuntu2","1:2014.1.2-0ubuntu1","1:2014.1.2-0ubuntu1.1","1:2014.1.3-0ubuntu1","1:2014.1.3-0ubuntu1.1","1:2014.1.3-0ubuntu2","1:2014.1.4-0ubuntu2","1:2014.1.4-0ubuntu2.1","1:2014.1.5-0ubuntu1","1:2014.1.5-0ubuntu1.1","1:2014.1.5-0ubuntu1.2","1:2014.1.5-0ubuntu1.3","1:2014.1.5-0ubuntu1.4","1:2014.1.5-0ubuntu1.5","1:2014.1.5-0ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2014.1.5-0ubuntu1.7"}]}],"versions":["1:2013.2~rc2-0ubuntu1","1:2013.2-0ubuntu1","1:2014.1~b1-0ubuntu1","1:2014.1~b1-0ubuntu2","1:2014.1~b2-0ubuntu3","1:2014.1~b2-0ubuntu4","1:2014.1~b3-0ubuntu1","1:2014.1~b3-0ubuntu2","1:2014.1~rc1-0ubuntu1","1:2014.1~rc2-0ubuntu1","1:2014.1-0ubuntu1","1:2014.1-0ubuntu1.2","1:2014.1.1-0ubuntu1","1:2014.1.1-0ubuntu2","1:2014.1.2-0ubuntu1","1:2014.1.2-0ubuntu1.1","1:2014.1.3-0ubuntu1","1:2014.1.3-0ubuntu1.1","1:2014.1.3-0ubuntu2","1:2014.1.4-0ubuntu2","1:2014.1.4-0ubuntu2.1","1:2014.1.5-0ubuntu1","1:2014.1.5-0ubuntu1.1","1:2014.1.5-0ubuntu1.2","1:2014.1.5-0ubuntu1.3","1:2014.1.5-0ubuntu1.4","1:2014.1.5-0ubuntu1.5","1:2014.1.5-0ubuntu1.6"],"bundled":7}],"products":[{"vendor":"openstack","product":"cinder"},{"vendor":"openstack","product":"glance"},{"vendor":"openstack","product":"nova"}],"references":[{"url":"https://launchpad.net/bugs/1449062","tags":["x_refsource_CONFIRM","x_transferred","Exploit","evidence","web"]},{"url":"http://www.securityfocus.com/bid/76849","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0153.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/10/06/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2923.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2991.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0165.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0156.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0282.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5162","tags":["advisory"]},{"url":"https://github.com/openstack/cinder/commit/455b318ced717fb38dfe40014817d78fbc47dea5","tags":["web"]},{"url":"https://github.com/openstack/glance/commit/69a9b659fd48aa3c1f84fc7bc9ae236b6803d31f","tags":["web"]},{"url":"https://github.com/openstack/nova/commit/6bc37dcceca823998068167b49aec6def3112397","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5162","tags":["web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1268303","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-g2j5-7vgx-6xrx","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-5162","tags":["advisory"]},{"url":"https://pypi.org/project/cinder","tags":["package"]},{"url":"https://pypi.org/project/glance","tags":["package"]},{"url":"https://pypi.org/project/nova","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2923","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1380842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1381283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1381350","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1386253","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2923.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5162","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2991","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1357461","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1379385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1381466","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1381534","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1381965","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1383899","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1385486","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1386263","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1387467","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1387617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1390109","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1396263","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2991.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0153","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0153.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0156","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1198169","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1370012","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0156.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0165","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0165.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0282","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1316791","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1349005","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1365899","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1370598","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1378906","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1380289","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1381533","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1383415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1386268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1391970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1394964","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1399760","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1409820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1410046","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1416884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1420451","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0282.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-5162","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3449-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-3241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7713","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2140","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-5162","description":"The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.","status":"published","published":"2016-10-07T14:00:00Z","modified":"2024-08-06T06:41:07.567Z","updated_at":"2026-11-02T14:35:39.846011Z"}],"euvd":[{"id":"EUVD-2022-3861","description":"The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.","status":"published","published":"2016-10-07T14:00:00Z","modified":"2024-08-06T06:41:07Z","updated_at":"2026-11-03T02:22:01.305851Z"}],"ghsa":[{"id":"GHSA-g2j5-7vgx-6xrx","title":"OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption","description":"The image parser in OpenStack Cinder prior to 7.0.2, and 8.0.0 and above, prior to 9.0.0; Glance prior to 14.00; and Nova prior to 12.0.4 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image. This issue is patched in Cinder 7.0.2 and 9.0.0; Glance 14.0.0; and Nova 12.0.4","status":"published","published":"2022-05-14T03:59:07Z","modified":"2023-02-13T20:22:26Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:44.81167Z"}],"nvd":[{"id":"CVE-2015-5162","description":"The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.","status":"published","published":"2016-10-07T14:59:01.52Z","modified":"2026-06-17T00:28:35.223Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:03:16.97467Z"}],"osv":[{"id":"CVE-2015-5162","description":"The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.","status":"published","published":"2016-10-07T14:59:01Z","modified":"2026-07-13T16:42:50.002649121Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-5162","description":"The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.","status":"published","published":"2016-10-07T14:59:01.52Z","modified":"2026-10-31T04:00:05.58874896Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"GHSA-g2j5-7vgx-6xrx","title":"OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption","description":"The image parser in OpenStack Cinder prior to 7.0.2, and 8.0.0 and above, prior to 9.0.0; Glance prior to 14.00; and Nova prior to 12.0.4 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image. This issue is patched in Cinder 7.0.2 and 9.0.0; Glance 14.0.0; and Nova 12.0.4","status":"published","published":"2022-05-14T03:59:07Z","modified":"2026-07-13T16:42:50.002649121Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"PYSEC-2026-2412","title":"OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption","description":"The image parser in OpenStack Cinder prior to 7.0.2, and 8.0.0 and above, prior to 9.0.0; Glance prior to 14.00; and Nova prior to 12.0.4 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image. This issue is patched in Cinder 7.0.2 and 9.0.0; Glance 14.0.0; and Nova 12.0.4","status":"published","published":"2026-07-09T16:49:46.203913Z","modified":"2026-07-13T16:42:50.002649121Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.961245Z"},{"id":"PYSEC-2026-2491","title":"OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption","description":"The image parser in OpenStack Cinder prior to 7.0.2, and 8.0.0 and above, prior to 9.0.0; Glance prior to 14.00; and Nova prior to 12.0.4 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image. This issue is patched in Cinder 7.0.2 and 9.0.0; Glance 14.0.0; and Nova 12.0.4","status":"published","published":"2026-07-09T16:49:46.346045Z","modified":"2026-07-13T16:42:50.002649121Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.961245Z"},{"id":"PYSEC-2026-871","title":"OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption","description":"The image parser in OpenStack Cinder prior to 7.0.2, and 8.0.0 and above, prior to 9.0.0; Glance prior to 14.00; and Nova prior to 12.0.4 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image. This issue is patched in Cinder 7.0.2 and 9.0.0; Glance 14.0.0; and Nova 12.0.4","status":"published","published":"2026-07-06T08:03:24.240424Z","modified":"2026-07-13T16:42:50.002649121Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"RHSA-2016:2923","title":"Red Hat Security Advisory: openstack-cinder and openstack-glance security update","status":"published","published":"2024-09-13T10:39:49Z","modified":"2026-06-29T10:14:37Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:2991","title":"Red Hat Security Advisory: openstack-cinder, openstack-glance, and openstack-nova update","status":"published","published":"2024-09-13T10:39:44Z","modified":"2026-06-29T10:14:41Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2017:0153","title":"Red Hat Security Advisory: openstack-cinder security update","status":"published","published":"2024-09-13T10:39:37Z","modified":"2026-06-29T10:14:51Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:0156","title":"Red Hat Security Advisory: openstack-cinder security update","status":"published","published":"2024-09-13T10:39:48Z","modified":"2026-06-29T10:14:52Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:0165","title":"Red Hat Security Advisory: openstack-cinder security update","status":"published","published":"2024-09-13T10:39:43Z","modified":"2026-06-29T10:14:53Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:0282","title":"Red Hat Security Advisory: openstack-cinder, openstack-glance, and openstack-nova security update","status":"published","published":"2024-09-13T10:39:53Z","modified":"2026-06-29T10:15:10Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2015-5162","description":"The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.","status":"published","published":"2016-10-07T00:00:00Z","modified":"2026-02-04T03:04:22.47472Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"USN-3449-1","title":"nova vulnerabilities","description":"George Shuklin discovered that OpenStack Nova incorrectly handled the\nmigration process. A remote authenticated user could use this issue to\nconsume resources, resulting in a denial of service. (CVE-2015-3241)\n\nGeorge Shuklin and Tushar Patil discovered that OpenStack Nova incorrectly\nhandled deleting instances. A remote authenticated user could use this\nissue to consume disk resources, resulting in a denial of service.\n(CVE-2015-3280)\n\nIt was discovered that OpenStack Nova incorrectly limited qemu-img calls. A\nremote authenticated user could use this issue to consume resources,\nresulting in a denial of service. (CVE-2015-5162)\n\nMatthew Booth discovered that OpenStack Nova incorrectly handled snapshots.\nA remote authenticated user could use this issue to read arbitrary files.\n(CVE-2015-7548)\n\nSreekumar S. and Suntao discovered that OpenStack Nova incorrectly applied\nsecurity group changes. A remote attacker could possibly use this issue to\nbypass intended restriction changes by leveraging an instance that was\nrunning when the change was made. (CVE-2015-7713)\n\nMatt Riedemann discovered that OpenStack Nova incorrectly handled logging.\nA local attacker could possibly use this issue to obtain sensitive\ninformation from log files. (CVE-2015-8749)\n\nMatthew Booth discovered that OpenStack Nova incorrectly handled certain\nqcow2 headers. A remote authenticated user could possibly use this issue to\nread arbitrary files. (CVE-2016-2140)\n","status":"published","published":"2017-10-11T11:46:58Z","modified":"2026-02-10T04:41:13Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}