{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"11.0.0"}],"component":"glance","cve_ids":["CVE-2015-8234"],"ecosystem":"PyPI","epss":0.01262,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-wmhw-fvg9-87fc","id":"tcs_01M5KG7381DK305B6DXM45HPV9","modified_at":"2024-11-25T22:42:25.406908Z","published_at":"2017-03-29T14:59:00Z","references":["https://osv.dev/vulnerability/PYSEC-2017-143","https://wiki.openstack.org/wiki/OSSN/OSSN-0061","https://bugs.launchpad.net/glance/+bug/1516031","http://seclists.org/oss-sec/2015/q4/303"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"PYSEC-2017-143","url":"https://osv.dev/vulnerability/PYSEC-2017-143"}],"summary":"The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted image, which triggers an MD5 collision."}