CVE-2015-5163

Name	CVE-2015-5163
Description	The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs	795453

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
glance (PTS)	buster	2:17.0.0-4	fixed
	buster (security)	2:17.0.0-5+deb10u1	fixed
	bullseye (security), bullseye	2:21.0.0-2+deb11u1	fixed
	bookworm, sid	2:25.1.0-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
glance	source	wheezy	(not affected)
glance	source	jessie	(not affected)
glance	source	(unstable)	2015.1.0-4	795453

Notes

[jessie] - glance <not-affected> (Affects Glance 2015.1 versions trough 2015.1.1)
[wheezy] - glance <not-affected> (Affects Glance 2015.1 versions trough 2015.1.1)