Skip to content
OpenAdvisories
Unscored USN-2405-1 2 CVEs

cinder vulnerabilities

Published Nov 11, 2014 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Duncan Thomas discovered that OpenStack Cinder did not properly track the
file format when using the GlusterFS of Smbfs drivers. A remote
authenticated user could exploit this to potentially obtain file contents
from the compute host. (CVE-2014-3641)

Amrith Kumar discovered that OpenStack Cinder did not properly sanitize log
message contents. Under certain circumstances, a local attacker with read
access to Cinder log files could obtain access to sensitive information.
(CVE-2014-7230)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS cinder 1:2014.1.3-0ubuntu1.1

Vulnerabilities 2

  • Medium —
    CVE-2014-3641

    OpenStack Cinder Exposure of Sensitive Information to an Unauthorized Actor vulnerability

    The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header.

    cinder cinder cinder Debian Ubuntu PyPI
  • Unscored —
    CVE-2014-7230

    The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 befor…

    nova nova cinder cinder Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2014-3641
  • report
    https://ubuntu.com/security/CVE-2014-7230