Skip to content
OpenAdvisories
Medium RHSA-2024:4272 1 CVE

Red Hat Security Advisory: Red Hat OpenStack Platform 17.1.3 security update

Published Sep 27, 2024 · Updated Mar 21, 2026

Ecosystem: Red Hat

Fixed packages 16

ReleasePackageFixed in
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-cinder 1:18.2.2-17.1.20231011140829.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-glance 1:22.1.2-17.1.20230621071326.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-nova 1:23.2.3-17.1.20231018130828.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-nova-api 1:23.2.3-17.1.20231018130828.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-nova-common 1:23.2.3-17.1.20231018130828.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-nova-compute 1:23.2.3-17.1.20231018130828.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-nova-conductor 1:23.2.3-17.1.20231018130828.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-nova-migration 1:23.2.3-17.1.20231018130828.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-nova-novncproxy 1:23.2.3-17.1.20231018130828.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-nova-scheduler 1:23.2.3-17.1.20231018130828.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-nova-serialproxy 1:23.2.3-17.1.20231018130828.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-nova-spicehtml5proxy 1:23.2.3-17.1.20231018130828.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 python3-cinder 1:18.2.2-17.1.20231011140829.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 python3-cinder-common 1:18.2.2-17.1.20231011140829.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 python3-glance 1:22.1.2-17.1.20230621071326.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 python3-nova 1:23.2.3-17.1.20231018130828.el9ost

Vulnerabilities 1

  • Medium 6.5
    CVE-2024-32498

    OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access

    An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenti…

    nova nova glance nova Debian Ubuntu PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#critical
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278663
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4272.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-32498
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-32498
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-32498
  • article
    https://bugs.launchpad.net/nova/+bug/2059809
  • article
    https://www.openwall.com/lists/oss-security/2024/07/02/2