CVE catalog
CVE-2017-7200
An SSRF issue was discovered in OpenStack Glance before Newton. The 'copy_from' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to
- Severity
- Medium · CVSS 6.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 2.06% · Oct 25, 2026
An SSRF issue was discovered in OpenStack Glance before Newton. The 'copy_from' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to enumerate internal network details while appearing masked, since the scan would appear to originate from the Glance Image service.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | glance | sid | 2:33.0.0-6 | fixed |
| Debian | glance | trixie | 2:30.0.0-3+deb13u2 | fixed |
| Debian | glance | bookworm | 2:25.1.0-2+deb12u3 | fixed |
| Debian | glance | bookworm-security | 2:25.1.0-2+deb12u5 | fixed |
| Cpe | glance | Not reported | 11.0.0 | fixed |
| Ubuntu | glance | pro | 2:11.0.0-0ubuntu1 | vulnerable |
| Ubuntu | glance | pro | 2:12.0.0~b1-0ubuntu1 | vulnerable |
| Ubuntu | glance | pro | 2:12.0.0~b2-0ubuntu1 | vulnerable |
| Ubuntu | glance | pro | 2:12.0.0~b3-0ubuntu1 | vulnerable |
| Ubuntu | glance | pro | 2:12.0.0~rc1-0ubuntu1 | vulnerable |
| Ubuntu | glance | pro | 2:12.0.0-0ubuntu1 | vulnerable |
| Ubuntu | glance | pro | 2:12.0.0-0ubuntu2 | vulnerable |
| Ubuntu | glance | pro | 2:12.0.0-0ubuntu2+esm1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | glance | source | sid | 2:13.0.0-1 | not yet assigned | Not reported | Not reported |
| Debian | glance | source | trixie | 2:13.0.0-1 | not yet assigned | Not reported | Not reported |
| Debian | glance | source | bookworm | 2:13.0.0-1 | not yet assigned | Not reported | Not reported |
| Cpe | glance | cpe | Not reported | 11.0.0 | Not reported | NVD-CVE-2017-7200 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [glance]Unknown
Details (4)
2:25.1.0-2+deb12u3· all · bookwormFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
2:25.1.0-2+deb12u3· all · bookwormFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
2:25.1.0-2+deb12u1· all · bookworm-securityFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
2:25.1.0-2+deb12u1· all · bookworm-securityFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
- [glance-api]Unknown
Source package: [glance]
Details (4)
2:25.1.0-2+deb12u3· all · bookwormFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
2:25.1.0-2+deb12u3· all · bookwormFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
2:25.1.0-2+deb12u1· all · bookworm-securityFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
2:25.1.0-2+deb12u1· all · bookworm-securityFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
- [glance-common]Unknown
Source package: [glance]
Details (4)
2:25.1.0-2+deb12u3· all · bookwormFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
2:25.1.0-2+deb12u3· all · bookwormFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
2:25.1.0-2+deb12u1· all · bookworm-securityFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
2:25.1.0-2+deb12u1· all · bookworm-securityFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
- [glance-doc]Unknown
Source package: [glance]
Details (4)
2:25.1.0-2+deb12u3· all · bookwormFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
2:25.1.0-2+deb12u3· all · bookwormFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
2:25.1.0-2+deb12u1· all · bookworm-securityFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
2:25.1.0-2+deb12u1· all · bookworm-securityFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
- [python3-glance]Unknown
Source package: [glance]
Details (4)
2:25.1.0-2+deb12u3· all · bookwormFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
2:25.1.0-2+deb12u3· all · bookwormFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
2:25.1.0-2+deb12u1· all · bookworm-securityFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
2:25.1.0-2+deb12u1· all · bookworm-securityFixed · Fixed:
2:13.0.0-1nvd · glance · debian · bookworm; nvd · glance · debian · 12
[Debian 13 (Trixie)]
- [glance]Unknown
Details (2)
2:30.0.0-3+deb13u2· all · trixieFixed · Fixed:
2:13.0.0-1nvd · glance · debian · 13
2:30.0.0-3+deb13u2· all · trixieFixed · Fixed:
2:13.0.0-1nvd · glance · debian · 13
- [glance-api]Unknown
Source package: [glance]
Details (2)
2:30.0.0-3+deb13u2· all · trixieFixed · Fixed:
2:13.0.0-1nvd · glance · debian · 13
2:30.0.0-3+deb13u2· all · trixieFixed · Fixed:
2:13.0.0-1nvd · glance · debian · 13
- [glance-common]Unknown
Source package: [glance]
Details (2)
2:30.0.0-3+deb13u2· all · trixieFixed · Fixed:
2:13.0.0-1nvd · glance · debian · 13
2:30.0.0-3+deb13u2· all · trixieFixed · Fixed:
2:13.0.0-1nvd · glance · debian · 13
- [glance-doc]Unknown
Source package: [glance]
Details (2)
2:30.0.0-3+deb13u2· all · trixieFixed · Fixed:
2:13.0.0-1nvd · glance · debian · 13
2:30.0.0-3+deb13u2· all · trixieFixed · Fixed:
2:13.0.0-1nvd · glance · debian · 13
- [python3-glance]Unknown
Source package: [glance]
Details (2)
2:30.0.0-3+deb13u2· all · trixieFixed · Fixed:
2:13.0.0-1nvd · glance · debian · 13
2:30.0.0-3+deb13u2· all · trixieFixed · Fixed:
2:13.0.0-1nvd · glance · debian · 13
Observed:
References
- [https://nvd.nist.gov/vuln/detail/CVE-2017-7200]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2017-7200]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2017-7200]
- [https://security-tracker.debian.org/tracker/CVE-2017-7200]
- [https://security.access.redhat.com/data/csaf/v2/vex/2017/cve-2017-7200.json]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]