CVE-2017-7200

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2017-7200

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-7200.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2017-7200

Aliases

Downstream

Published

2017-03-21T06:59:00Z

Modified

2026-09-19T08:35:38Z

Severity

5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS Calculator

Summary

[none]

Details

An SSRF issue was discovered in OpenStack Glance before Newton. The 'copy_from' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to enumerate internal network details while appearing masked, since the scan would appear to originate from the Glance Image service.

References

Affected packages

Git / github.com/openstack/glance

Affected ranges

Type

GIT

Repo

https://github.com/openstack/glance

Events

Introduced

Fixed

69516fad5f651a085a047a337a05c58b39023c1b

Database specific

Show details

{
    "cpe": "cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "11.0.0"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

11.*

11.0.0.0b1

11.0.0.0b2

11.0.0.0b3

11.0.0.0rc1

11.0.0.0rc2

11.0.0a0

2011.*

2011.2

2013.*

2013.1.g3

2013.1.rc1

2013.2.b1

2013.2.b2

2013.2.rc1

2014.*

2014.1.b1

2014.1.b2

2014.1.b3

2014.1.rc1

2014.2.b1

2014.2.b2

2014.2.b3

2014.2.rc1

2015.*

2015.1.0b1

2015.1.0b2

2015.1.0b3

2015.1.0rc1

Other

essex-1

essex-3

folsom-2

folsom-3

grizzly-1

grizzly-2

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-7200.json"