-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| glance | pip | < 2014.2.4 | 2014.2.4 |
| glance | pip | >= 2015.1.0, < 2015.1.2 | 2015.1.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper validation of the x-image-meta-status header in v1 API requests. The patch adds validation logic to the ImagesController.update() method in glance/api/v1/images.py, specifically checking if the provided status matches the current image status. This indicates that prior to the patch, the update method processed these headers without proper authorization checks, making it the entry point for the vulnerability. The function signature matches the API endpoint structure and would appear in profilers handling image update operations.