CVE-2013-4354

Name	CVE-2013-4354
Description	The API before 2.1 in OpenStack Image Registry and Delivery Service (Glance) makes it easier for local users to inject images into arbitrary tenants by adding the tenant as a member of the image.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
glance (PTS)	buster	2:17.0.0-4	vulnerable
	buster (security)	2:17.0.0-5+deb10u1	vulnerable
	bullseye (security), bullseye	2:21.0.0-2+deb11u1	vulnerable
	bookworm, sid	2:25.1.0-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
glance	source	(unstable)	(unfixed)	unimportant

https://bugs.launchpad.net/glance/+bug/1226078
according to upstream bug there will probably not be a patch for this issue