Skip to content
OpenAdvisories
Medium USN-4420-1 1 CVE

cinder, python-os-brick vulnerability

Published Jul 7, 2020 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

David Hill and Eric Harney discovered that Cinder and os-brick incorrectly
handled ScaleIO backend credentials. An attacker could possibly use this issue to
expose sensitive information.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS cinder 2:12.0.9-0ubuntu1.2
Ubuntu · 18.04 LTS 18.04:LTS python-os-brick 2.3.0-0ubuntu1.2
Ubuntu · 20.04 LTS 20.04:LTS cinder 2:16.1.0-0ubuntu1
Ubuntu · 20.04 LTS 20.04:LTS python-os-brick 3.0.1-0ubuntu1.2

Vulnerabilities 1

  • Medium 6.5
    CVE-2020-10755

    Openstack cinder Improper handling of ScaleIO backend credentials

    An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using ope…

    Red Hat openstack-cinder cinder cinder Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2020-10755