Is CVE-2013-1840 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2013-1840 being exploited in the wild.

How severe is CVE-2013-1840?

Low severity, with a CVSS score of 3.5, published 17 May 2022.

Which products and versions are affected?

glance (PyPI) ECOSYSTEM:introduced=0,fixed=11.0.0a0, ECOSYSTEM:introduced=0,last_affected=v1.

Is there a fix for CVE-2013-1840?

Yes. glance (PyPI): upgrade to 11.0.0a0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2013-1840 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2013-1840?

Check whether you run glance (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2013-1840: OpenStack Glance credential leak in v1 API cached image requests

CVE-2013-1840 · Severity: low · CVSS 3.5 · Published 2022-05-17

OpenStack Glance, a service for managing virtual machine images, is vulnerable to a credential leak. When certain storage configurations are used, an authenticated user can retrieve the administrator's backend storage credentials (such as for Amazon S3 or Swift) simply by requesting a cached image. This could allow an attacker to gain unauthorized access to the underlying storage system where all virtual machine images are kept.

Technologies: glance (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2013-1840 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2013-1840 being exploited in the wild.
How severe is CVE-2013-1840?: Low severity, with a CVSS score of 3.5, published 17 May 2022.
Which products and versions are affected?: glance (PyPI) ECOSYSTEM:introduced=0,fixed=11.0.0a0, ECOSYSTEM:introduced=0,last_affected=v1.
Is there a fix for CVE-2013-1840?: Yes. glance (PyPI): upgrade to 11.0.0a0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2013-1840 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2013-1840?: Check whether you run glance (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

glance (PyPI): upgrade to 11.0.0a0 or later
```
pip install "glance>=11.0.0a0"
```

Technical details

An information exposure vulnerability exists in the OpenStack Glance v1 API when configured with single-tenant Swift or S3 storage backends. The vulnerability is rooted in the `_inject_location_header` function within the image serializer, which fails to strip sensitive backend location metadata when serving cached images. A remote authenticated attacker can trigger this by requesting a cached image, causing the server to return the `X-Image-Meta-Location` header containing plaintext credentials for the storage provider. This issue affects Glance versions Essex (2012.1), Folsom (2012.2), and Grizzly. Patches were released to ensure the location field is deleted from the image metadata before the response headers are populated.

Affected products

OpenStack Glance Essex (2012.1), Folsom (2012.2), Grizzly

Identifiers

CVE-2013-1840
GHSA-c8w9-83vg-r8vv
PYSEC-2013-46

Timeline

2013-02-28: disclosed: Bug reported on Launchpad by Stuart McLaren
2013-03-22: advisory: NVD published CVE-2013-1840
2013-04-04: patched: Red Hat released security update RHSA-2013:0707

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.