Skip to content
OpenAdvisories
Medium USN-6882-1 1 CVE

cinder vulnerability

Published Jul 8, 2024 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Martin Kaesberger discovered that Cinder incorrectly handled QCOW2 image
processing. An authenticated user could use this issue to access arbitrary
files on the server, possibly exposing sensitive information.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS cinder 2:16.4.2-0ubuntu2.8
Ubuntu · 22.04 LTS 22.04:LTS cinder 2:20.3.1-0ubuntu1.4
Ubuntu · 24.04 LTS 24.04:LTS cinder 2:24.0.0-0ubuntu1.2

Vulnerabilities 1

  • Medium 6.5
    CVE-2024-32498

    OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access

    An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenti…

    nova nova glance nova Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2024-32498