CVE-2016-8611 Denial of service in openstack-glance
Medium 4.3
Published
Updated
Check this codebase for CVE-2016-8611 and fix it if it is affected.
What it is: CVE-2016-8611 is a medium-severity denial of service vulnerability in The Openstack Foundation openstack-glance, published on 31 Jul 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2016-8611 in the wild and no public exploit code.
Affected product: The Openstack Foundation openstack-glance. No package-level version data is available, so check the vendor advisory linked from the reference page.
Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.
Reference: https://insights.sbomify.com/CVE-2016-8611/ (Markdown: https://insights.sbomify.com/CVE-2016-8611/index.md)
Authenticated users can cause denial of service in OpenStack Glance by saturating the database via unlimited image creation requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-8611?
CVE-2016-8611 is a medium-severity denial of service vulnerability in The Openstack Foundation openstack-glance, published on 31 Jul 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 `/images` API POST method for authenticated users, resulting in possible denial of service attacks through database table saturation.
Which versions are affected by CVE-2016-8611?
It affects 1 product.
Linux distribution packages (36)
ardana-ansible SUSE:HPE Helion OpenStack 8 | All versions | 8.0+git.1539739656.0ef51c9-3.46.1 |
ardana-barbican SUSE:HPE Helion OpenStack 8 | All versions | 8.0+git.1534266594.8136db7-4.27.2 |
ardana-cinder SUSE:HPE Helion OpenStack 8 | All versions | 8.0+git.1535412193.d9ad231-3.27.2 |
ardana-cluster SUSE:HPE Helion OpenStack 8 | All versions | 8.0+git.1534266734.ec4822f-3.30.2 |
ardana-cobbler SUSE:HPE Helion OpenStack 8 | All versions | 8.0+git.1534780521.780753b-3.29.2 |
ardana-freezer SUSE:HPE Helion OpenStack 8 | All versions | 8.0+git.1534266805.c9ea29b-3.12.2 |
ardana-glance SUSE:HPE Helion OpenStack 8 | All versions | 8.0+git.1537790499.b15fdea-3.8.2 |
ardana-input-model SUSE:HPE Helion OpenStack 8 | All versions | 8.0+git.1539086744.5ae1d6f-3.21.2 |
ardana-keystone SUSE:HPE Helion OpenStack 8 | All versions | 8.0+git.1536100286.ddd8d3e-3.15.2 |
ardana-mq SUSE:HPE Helion OpenStack 8 | All versions | 8.0+git.1534267034.f95e1ec-3.5.2 |
ardana-neutron SUSE:HPE Helion OpenStack 8 | All versions | 8.0+git.1537805998.7898f24-3.21.2 |
ardana-nova SUSE:HPE Helion OpenStack 8 | All versions | 8.0+git.1537895345.35a03a2-3.14.2 |
ardana-octavia SUSE:HPE Helion OpenStack 8 | All versions | 8.0+git.1534267086.b7dbe77-3.8.2 |
ardana-osconfig SUSE:HPE Helion OpenStack 8 | All versions | 8.0+git.1540330973.aab0174-3.27.1 |
ardana-service SUSE:HPE Helion OpenStack 8 | All versions | 8.0+git.1537825617.23552c2-3.14.2 |
ardana-service-ansible SUSE:HPE Helion OpenStack 8 | All versions | 8.0+git.1537806377.25b5d68-3.11.2 |
ardana-ses SUSE:HPE Helion OpenStack 8 | All versions | 8.0+git.1539113493.6631423-1.8.2 |
ardana-swift SUSE:HPE Helion OpenStack 8 | All versions | 8.0+git.1534267211.78fb7e3-3.18.2 |
ardana-ansible SUSE:OpenStack Cloud 8 | All versions | 8.0+git.1539739656.0ef51c9-3.46.1 |
ardana-barbican SUSE:OpenStack Cloud 8 | All versions | 8.0+git.1534266594.8136db7-4.27.2 |
ardana-cinder SUSE:OpenStack Cloud 8 | All versions | 8.0+git.1535412193.d9ad231-3.27.2 |
ardana-cluster SUSE:OpenStack Cloud 8 | All versions | 8.0+git.1534266734.ec4822f-3.30.2 |
ardana-cobbler SUSE:OpenStack Cloud 8 | All versions | 8.0+git.1534780521.780753b-3.29.2 |
ardana-freezer SUSE:OpenStack Cloud 8 | All versions | 8.0+git.1534266805.c9ea29b-3.12.2 |
ardana-glance SUSE:OpenStack Cloud 8 | All versions | 8.0+git.1537790499.b15fdea-3.8.2 |
ardana-input-model SUSE:OpenStack Cloud 8 | All versions | 8.0+git.1539086744.5ae1d6f-3.21.2 |
ardana-keystone SUSE:OpenStack Cloud 8 | All versions | 8.0+git.1536100286.ddd8d3e-3.15.2 |
ardana-mq SUSE:OpenStack Cloud 8 | All versions | 8.0+git.1534267034.f95e1ec-3.5.2 |
ardana-neutron SUSE:OpenStack Cloud 8 | All versions | 8.0+git.1537805998.7898f24-3.21.2 |
ardana-nova SUSE:OpenStack Cloud 8 | All versions | 8.0+git.1537895345.35a03a2-3.14.2 |
ardana-octavia SUSE:OpenStack Cloud 8 | All versions | 8.0+git.1534267086.b7dbe77-3.8.2 |
ardana-osconfig SUSE:OpenStack Cloud 8 | All versions | 8.0+git.1540330973.aab0174-3.27.1 |
ardana-service SUSE:OpenStack Cloud 8 | All versions | 8.0+git.1537825617.23552c2-3.14.2 |
ardana-service-ansible SUSE:OpenStack Cloud 8 | All versions | 8.0+git.1537806377.25b5d68-3.11.2 |
ardana-ses SUSE:OpenStack Cloud 8 | All versions | 8.0+git.1539113493.6631423-1.8.2 |
ardana-swift SUSE:OpenStack Cloud 8 | All versions | 8.0+git.1534267211.78fb7e3-3.18.2 |
Products include Openstack Glance.
How do I fix CVE-2016-8611?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2016-8611 being exploited?
There is no known exploitation of CVE-2016-8611 in the wild and no public exploit code.
Other vulnerabilities in The Openstack Foundation openstack-glance
- CVE-2017-7200 OpenStack Glance Server-Side Request Forgery (SSRF)
- CVE-2015-8234 OpenStack Glance Signature Verification Bypass
- CVE-2026-34881 OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
- CVE-2015-3289 Denial of service in n/a
- CVE-2015-5163 OpenStack Image Service (Glance) allows remote authenticated users to read arbitrary file
Sources
Also known as DEBIAN-CVE-2016-8611, GHSA-c8qm-3x9v-xjgr, SUSE-RU-2018:3638-1, UBUNTU-CVE-2016-8611.