{"action":"Upgrade glance to 2015.1.2 or later.","affected":[{"fixed":"2015.1.2","introduced":"2015.1.0"}],"component":"glance","cve_ids":["CVE-2015-5163"],"ecosystem":"PyPI","epss":0.01499,"exploited":false,"fixed_versions":["2015.1.2"],"ghsa_id":"GHSA-q73f-vjc2-3gqf","id":"tcs_01M5KG6Q3QFB66S5DTCVC2BQK6","modified_at":"2024-11-25T22:42:16.804965Z","published_at":"2015-08-19T15:59:00Z","references":["https://osv.dev/vulnerability/PYSEC-2015-39","http://lists.openstack.org/pipermail/openstack-announce/2015-August/000527.html","http://rhn.redhat.com/errata/RHSA-2015-1639.html","https://bugs.launchpad.net/glance/+bug/1471912","http://www.securityfocus.com/bid/76346"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2015-39","url":"https://osv.dev/vulnerability/PYSEC-2015-39"}],"summary":"The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file"}