CVE-2022-4134 OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability

What is CVE-2022-4134?

CVE-2022-4134 is a low-severity missing authorization vulnerability in Redhat Openstack, published on 6 Mar 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images.

Weakness: CWE-829

Which versions are affected by CVE-2022-4134?

3 open source packages ship an affected version, including glance. It affects 2 products.

Products include Openstack Glance, Redhat Openstack.

How do I fix CVE-2022-4134?

No fix has been published for CVE-2022-4134 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-4134 being exploited?

There is no known exploitation of CVE-2022-4134 in the wild and no public exploit code.

Other vulnerabilities in Redhat Openstack

• CVE-2017-7200 OpenStack Glance Server-Side Request Forgery (SSRF) Medium 5.8
• CVE-2015-8234 OpenStack Glance Signature Verification Bypass Medium 5.5
• CVE-2026-34881 OpenStack Glance is affected by Server-Side Request Forgery (SSRF) Medium 5.0
• CVE-2016-8611 Denial of service in openstack-glance Medium 4.3
• CVE-2015-3289 Denial of service in n/a Medium 4.0

All Redhat Openstack vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5gp5-vxj6-4257, PYSEC-2023-270, UBUNTU-CVE-2022-4134.