Summary
USN-6882-1 fixed vulnerabilities in Cinder. The update caused a regression
in certain environments due to incorrect privilege handling. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Martin Kaesberger discovered that Cinder incorrectly handled QCOW2 image
processing. An authenticated user could use this issue to access arbitrary
files on the server, possibly exposing sensitive information.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | cinder | 2:16.4.2-0ubuntu2.9 |
| Ubuntu · 22.04 LTS 22.04:LTS | cinder | 2:20.3.1-0ubuntu1.5 |
| Ubuntu · 24.04 LTS 24.04:LTS | cinder | 2:24.0.0-0ubuntu1.3 |
Vulnerabilities 2
-
Medium 6.5
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenti…
-
Medium 5.7
OpenStack Cinder, glance, and Nova vulnerable to Path Traversal
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that refe…