Candidate: CVE-2017-7200
PublicDate: 2017-03-21 06:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7200
 https://wiki.openstack.org/wiki/OSSN/OSSN-0078
Description:
 An SSRF issue was discovered in OpenStack Glance before Newton. The
 'copy_from' feature in the Image Service API v1 allowed an attacker to
 perform masked network port scans. With v1, it is possible to create images
 with a URL such as 'http://localhost:22'. This could then allow an attacker
 to enumerate internal network details while appearing masked, since the
 scan would appear to originate from the Glance Image service.
Ubuntu-Description:
Notes:
 mdeslaur> no fix is available for this issue. Please see the upstream
 mdeslaur> for recommended workarounds.
Bugs:
 https://bugs.launchpad.net/ossn/+bug/1606495
 https://bugs.launchpad.net/ossn/+bug/1153614
Priority: low
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N [5.8 MEDIUM]

Patches_glance:
upstream_glance: released (2:13.0.0-1)
precise_glance: ignored (reached end-of-life)
precise/esm_glance: DNE (precise was needed)
trusty_glance: ignored
trusty/esm_glance: DNE (trusty was ignored)
vivid/stable-phone-overlay_glance: DNE
vivid/ubuntu-core_glance: DNE
xenial_glance: ignored
esm-infra/xenial_glance: ignored
yakkety_glance: ignored (reached end-of-life)
zesty_glance: not-affected (2:14.0.0-0ubuntu1)
devel_glance: not-affected (2:14.0.0-0ubuntu1)