Vulnerabilities in pkg:pypi/glance

PACKAGE
Advisory Identifier: GHSA-xv7j-2v4w-cjvh
Share
Advisory Summary

CVE-2013-0212 is a MODERATE openstack glance logs user name vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) affecting Glance libraries in the PyPI ecosystem. The issue involves openstack glance logs user name and password in cleartext. Remediation is available by upgrading affected packages to version 2012.2.3.

22 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:pypi/glance

22 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:pypi/glance. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-xv7j-2v4w-cjvh CVE-2013-0212 MODERATE OpenStack Glance logs user name and password in cleartext
GHSA-c8w9-83vg-r8vv CVE-2013-1840 LOW OpenStack Glance is vulnerable to Exposure of Sensitive Information
GHSA-mc26-q38v-83gv CVE-2026-34881 MODERATE OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
GHSA-q748-mcwg-xmqv CVE-2015-5251 MODERATE OpenStack Image Service (Glance) allows remote authenticated users to bypass access restrictions
GHSA-r4v4-w9pv-6fph CVE-2024-32498 HIGH OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
GHSA-7h75-hwxx-qpgc CVE-2022-47951 MODERATE OpenStack Cinder, glance, and Nova vulnerable to Path Traversal
GHSA-5gp5-vxj6-4257 CVE-2022-4134 LOW OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability
GHSA-4xw6-hj5p-4j79 CVE-2014-1948 MODERATE OpenStack Glance sensitive information disclosure via logs
GHSA-q73f-vjc2-3gqf CVE-2015-5163 HIGH OpenStack Image Service (Glance) allows remote authenticated users to read arbitrary file
GHSA-h737-q6g6-8wr6 CVE-2014-9684 HIGH OpenStack Glance Denial of service by creating a large number of images
GHSA-4jp4-3c62-r8jv CVE-2015-1881 HIGH OpenStack Glance Denial of service by creating a large number of images
GHSA-wmhw-fvg9-87fc CVE-2015-8234 MODERATE OpenStack Glance Signature Verification Bypass
GHSA-6rrm-xxvh-7r87 CVE-2012-4573 MODERATE OpenStack Glance arbitrary deletion of non-protected images
GHSA-vwr9-9f8v-vp5m CVE-2012-5482 MODERATE OpenStack Glance arbitrary deletion of non-protected images
GHSA-j4mh-9wq6-8rg6 CVE-2014-9623 MODERATE OpenStack Glance Bypass the storage quota and Denial of service
GHSA-479j-jf2p-38pg CVE-2014-5356 MODERATE OpenStack Glance improper validation of the image_size_cap configuration option
GHSA-j6mr-cm6x-h6jg CVE-2017-7200 MODERATE OpenStack Glance Server-Side Request Forgery (SSRF)
GHSA-pwrj-f53c-f89j CVE-2015-1195 MODERATE OpenStack Glance v2 API unrestricted path traversal through filesystem:// scheme
GHSA-r7pj-rvwg-vxhr CVE-2014-0162 MODERATE OpenStack Image Registry and Delivery Service (Glance) Improper Input Validation vulnerability
GHSA-gvjg-r9fv-7qx9 CVE-2015-5286 MODERATE OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service
GHSA-5xrj-ghhp-hx7p CVE-2016-0757 MODERATE OpenStack Image Service (Glance) vulnerable to Improper Access Control
GHSA-g2j5-7vgx-6xrx CVE-2015-5162 HIGH OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption

CVE-2013-0212 at a Glance

CVE Identifier CVE-2013-0212
GHSA Identifier GHSA-xv7j-2v4w-cjvh
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected Product Glance
Package Ecosystem PyPI
Published Date
Last Updated

How to Fix CVE-2013-0212

To remediate this vulnerability, upgrade all affected Glance dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

glance fixed: 2012.2.3 
pip install glance>=2012.2.3
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show glance

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2013-0212, inspect your installed packages using pip:

pip show glance

Analyze the terminal output to locate any version of Glance in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2012.2.3), your application is affected.

Note: The pip show glance command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, where the product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. In Glance, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.

CVE-2013-0212 Affected Glance Versions

1 component(s)
Fixed Versions:
2012.2.3
Product / Package Ecosystem Affected Versions Fixed Version
glance
pypi/glance
PyPI
≥ 2012.1
< 2012.2.3
2012.2.3

References

NVD — CVE-2013-0212 NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-0212
Security Fix Commit FIX COMMIT
https://github.com/openstack/glance/commit/37d4d96bf88c2bf3e7e9511b5e321cf4bed364b7
Security Fix Commit FIX COMMIT
https://github.com/openstack/glance/commit/96a470be64adcef97f235ca96ed3c59ed954a4c1
Security Fix Commit FIX COMMIT
https://github.com/openstack/glance/commit/e96273112b5b5da58d970796b7cfce04c5030a89
access.redhat.com/errata/rhsa-2013:02... WEB
https://access.redhat.com/errata/RHSA-2013:0209
Glance Security Information SECURITY
https://access.redhat.com/security/cve/CVE-2013-0212
bugs.launchpad.net/glance/+bug/1098962 WEB
https://bugs.launchpad.net/glance/+bug/1098962
bugzilla.redhat.com/show_bug.cgi WEB
https://bugzilla.redhat.com/show_bug.cgi?id=902964
Glance Source Repository REPOSITORY
https://github.com/openstack/glance
Glance Source Repository REPOSITORY
https://github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2013-37.yaml
launchpad.net/glance/+milestone/2... WEB
https://launchpad.net/glance/+milestone/2012.2.3
lists.launchpad.net/openstack/msg20517.... WEB
https://lists.launchpad.net/openstack/msg20517.html
rhn.redhat.com/errata/rhsa-2013-02... WEB
http://rhn.redhat.com/errata/RHSA-2013-0209.html
ubuntu.com/usn/usn-1710-1 WEB
http://ubuntu.com/usn/usn-1710-1
Glance Security Information SECURITY
http://www.openwall.com/lists/oss-security/2013/01/29/10

Frequently Asked Questions

What is CVE-2013-0212?
CVE-2013-0212 is a security vulnerability in Glance involving OpenStack Glance logs user name and password in cleartext under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Which Glance versions are affected?
Affected versions include releases prior to 2012.2.3 across affected packages: glance.
What version fixes CVE-2013-0212?
Upgrading to 2012.2.3 (or the latest patched release for your respective branch) resolves the vulnerability.
Is glance affected?
Yes, glance is affected in releases prior to 2012.2.3. Upgrade your dependency to 2012.2.3 or later.
What CWE is associated with CVE-2013-0212?
CVE-2013-0212 is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.).
How can I check PyPI dependencies for CVE-2013-0212?
Run the dependency tree command: 'pip show glance'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xv7j-2v4w-cjvh",
  "modified" : "2026-06-10T18:47:11Z",
  "published" : "2022-05-05T02:48:35Z",
  "aliases" : [ "CVE-2013-0212" ],
  "summary" : "OpenStack Glance logs user name and password in cleartext ",
  "details" : "store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "glance"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2012.1"
      }, {
        "fixed" : "2012.2.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2013-0212"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openstack/glance/commit/37d4d96bf88c2bf3e7e9511b5e321cf4bed364b7"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openstack/glance/commit/96a470be64adcef97f235ca96ed3c59ed954a4c1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openstack/glance/commit/e96273112b5b5da58d970796b7cfce04c5030a89"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2013:0209"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/CVE-2013-0212"
  }, {
    "type" : "WEB",
    "url" : "https://bugs.launchpad.net/glance/+bug/1098962"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=902964"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/openstack/glance"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2013-37.yaml"
  }, {
    "type" : "WEB",
    "url" : "https://launchpad.net/glance/+milestone/2012.2.3"
  }, {
    "type" : "WEB",
    "url" : "https://lists.launchpad.net/openstack/msg20517.html"
  }, {
    "type" : "WEB",
    "url" : "http://rhn.redhat.com/errata/RHSA-2013-0209.html"
  }, {
    "type" : "WEB",
    "url" : "http://ubuntu.com/usn/usn-1710-1"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2013/01/29/10"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-11-22T20:19:01Z",
    "nvd_published_at" : "2013-02-24T21:55:00Z"
  }
}