Description
OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cinder | 2015.1.0+2015.06.16.git26.9634b76ba5-1 | — |
| Debian 13 | cinder | 2015.1.0+2015.06.16.git26.9634b76ba5-1 | — |
| Debian 12 | cinder | 2015.1.0+2015.06.16.git26.9634b76ba5-1 | — |
| Debian 8 | cinder | 2014.1.3-11+deb8u1 | DSA-3292-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 6 | python-cinder +2 | 2014.2.3-3.1.el7ost | RHSA-2015:1206 |
| Red Hat OpenStack 5 | python-cinder +2 | 2014.1.4-1.1.el6ost | RHSA-2015:1206 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | cinder | < 7.0.0a0 | 7.0.0a0 | GHSA-9hcj-h2qc-689p |
Advisories 2
- RHSA-2015:1206 Red Hat Security Advisory: openstack-cinder security and bug fix update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- DSA-3292-1 cinder - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- [openstack-announce] 20150616 [OSSA 2015-011.1] Cinder host file disclosure through qcow2 backing file (CVE-2015-1851) ERRATA 1 mailing-list
- DSA-3292 vendor-advisory
- [oss-security] 20150613 CVE-2015-1850: OpenStack Cinder/Nova: Format-guessing and file disclosure in image convert mailing-list
- [oss-security] 20150617 Re: [OSSA 2015-011] Cinder host file disclosure through qcow2 backing file (CVE-2015-1850) mailing-list
- RHSA-2015:1206 vendor-advisory
- USN-2703-1 vendor-advisory
- [oss-security] 20150617 Re: [OSSA 2015-011] Cinder host file disclosure through qcow2 backing file (CVE-2015-1850) mailing-list
- https://bugs.launchpad.net/cinder/+bug/1415087