VYPR
Get started
← All advisories
Low severityNVD Advisory· Published Mar 22, 2013· Updated Apr 29, 2026

CVE-2013-1840

CVE-2013-1840

Description

The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
glancePyPI
< 11.0.0a011.0.0a0

Affected products

1

Patches

3
e75764eee349

Do not return location in headers

https://github.com/openstack/glanceStuart McLarenMar 14, 2013via ghsa
commit
1 file changed · +3 −0
  • glance/api/middleware/cache.py+3 −0 modified
    @@ -147,6 +147,9 @@ def _fetch_request_info(request):
 
     def _process_v1_request(self, request, image_id, image_iterator):
         image_meta = registry.get_image_metadata(request.context, image_id)
+        # Don't display location
+        if 'location' in image_meta:
+            del image_meta['location']
         self._verify_metadata(image_meta)
 
         response = webob.Response(request=request)
74b067df9726

Do not return location in headers

https://github.com/openstack/glanceStuart McLarenMar 14, 2013via ghsa
commit
1 file changed · +3 −0
  • glance/api/middleware/cache.py+3 −0 modified
    @@ -79,6 +79,9 @@ def process_request(self, request):
             context = request.context
             try:
                 image_meta = registry.get_image_metadata(context, image_id)
+                # Don't display location
+                if 'location' in image_meta:
+                    del image_meta['location']
 
                 if not image_meta['size']:
                     # override image size metadata with the actual cached
dd849a9be540

Do not return location in headers

https://github.com/openstack/glanceStuart McLarenMar 14, 2013via ghsa
commit
1 file changed · +3 −0
  • glance/api/middleware/cache.py+3 −0 modified
    @@ -111,6 +111,9 @@ def process_request(self, request):
 
     def _process_v1_request(self, request, image_id, image_iterator):
         image_meta = registry.get_image_metadata(request.context, image_id)
+        # Don't display location
+        if 'location' in image_meta:
+            del image_meta['location']
 
         if not image_meta['size']:
             # override image size metadata with the actual cached

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

19

News mentions

0

No linked articles in our index yet.