-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| glance | pip | >= 2015.1.0, < 2015.1.2 | 2015.1.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the image import workflow in Glance's V2 API. The _ImportToFS task's execute method was responsible for staging images before further processing. Prior to the patch, this method lacked validation of qcow2 backing file references. Attackers could supply images with 'backing-filename' pointing to sensitive files (e.g., /etc/passwd), which would then be accessed during conversion tasks. The fix explicitly adds qemu-img metadata inspection in this method to block such imports, confirming this as the vulnerable entry point.