Description
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cinder | 2:21.0.0-3 | — |
| Debian 14 | glance | 2:25.0.0-2 | — |
| Debian 14 | nova | 2:26.0.0-6 | — |
| Debian 13 | cinder | 2:21.0.0-3 | — |
| Debian 13 | glance | 2:25.0.0-2 | — |
| Debian 13 | nova | 2:26.0.0-6 | — |
| Debian 12 | cinder | 2:21.0.0-3 | — |
| Debian 12 | glance | 2:25.0.0-2 | — |
| Debian 12 | nova | 2:26.0.0-6 | — |
| Debian 11 | cinder | 2:17.0.1-1+deb11u1 | DSA-5338-1 |
| Debian 11 | glance | 2:21.0.0-2+deb11u1 | DSA-5336-1 |
| Debian 11 | nova | 2:22.0.1-2+deb11u1 | DSA-5337-1 |
| Debian 10 | cinder | 2:13.0.7-1+deb10u2 | DLA-3301-1 |
| Debian 10 | glance | 2:17.0.0-5+deb10u1 | DLA-3300-1 |
| Debian 10 | nova | 2:18.1.0-6+deb10u2 | DLA-3302-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | cinder | 2:24.0.0-0ubuntu1.3 | USN-6882-2 |
| Ubuntu 22.04 LTS | cinder | 2:20.1.0-0ubuntu1 | USN-6882-2, USN-5835-1 |
| Ubuntu 22.04 LTS | glance | 2:24.1.0-0ubuntu1.1 | USN-5835-2 |
| Ubuntu 22.04 LTS | nova | 3:25.1.0-0ubuntu1 | USN-5835-3 |
| Ubuntu 20.04 LTS | cinder | 2:16.4.2-0ubuntu2.1 | USN-6882-2, USN-5835-4, USN-5835-1 |
| Ubuntu 20.04 LTS | glance | 2:20.2.0-0ubuntu1.1 | USN-5835-2 |
| Ubuntu 20.04 LTS | nova | 2:21.2.4-0ubuntu2.1 | USN-5835-3 |
| Ubuntu 18.04 LTS | cinder | 2:12.0.10-0ubuntu2.2 | USN-5835-4 |
| Ubuntu 18.04 LTS | nova | 2:17.0.13-0ubuntu5.2 | USN-5835-5 |
| Ubuntu 16.04 LTS | cinder | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | nova | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 17 | python3-cinder +2 | 1:18.2.1-0.20230202190311.1776695.el9ost | RHSA-2023:1016 |
| Red Hat OpenStack 17 | python3-glance +1 | 1:22.1.1-0.20220919210603.677c89c.el9ost | RHSA-2023:1017 |
| Red Hat OpenStack 17 | python3-nova +10 | 1:23.2.2-0.20221209190753.7074ac0.el9ost | RHSA-2023:1015 |
| Red Hat OpenStack 16 | python3-cinder +1 | 1:15.4.0-1.20230206163350.58f0e73.el8ost | RHSA-2023:1279 |
| Red Hat OpenStack 16 | python3-glance +1 | 1:19.0.4-1.20230207203320.5bbd356.el8ost | RHSA-2023:1280 |
| Red Hat OpenStack 16 | python3-nova +11 | 1:20.4.1-1.20221005193231.1ee93b9.el8ost | RHSA-2023:1278 |
| Red Hat OpenStack 13 | python-cinder +1 | 1:12.0.10-27.el7ost | RHSA-2023:1279 |
| Red Hat OpenStack 13 | python-glance +2 | 1:16.0.1-13.el7ost | RHSA-2023:1280 |
| Red Hat OpenStack 13 | python-nova +15 | 1:17.0.13-40.el7ost | RHSA-2023:1278 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 9 | openstack-cinder | 13.0.10~dev24-3.37.2 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-glance | 17.0.1~dev30-3.6.2 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron-gbp | 14.0.1~dev58-3.40.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-nova | 18.3.1~dev92-3.46.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud Crowbar 9 | python-oslo.utils | 3.36.5-3.6.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-cinder | 11.2.3~dev29-3.31.2 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-cinder-doc | 11.2.3~dev29-3.31.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-nova | 16.1.9~dev92-3.51.2 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-nova-doc | 16.1.9~dev92-3.51.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-oslo.utils | 3.28.4-3.9.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 9 | openstack-cinder | 13.0.10~dev24-3.37.2 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | openstack-glance | 17.0.1~dev30-3.6.2 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | openstack-neutron-gbp | 14.0.1~dev58-3.40.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | openstack-nova | 18.3.1~dev92-3.46.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | python-oslo.utils | 3.36.5-3.6.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-barbican | 7.0.1~dev24-3.39.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-cinder | 13.0.10~dev24-3.40.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-designate | 7.0.2~dev2-3.37.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-glance | 17.0.1~dev30-3.35.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-heat | 11.0.4~dev4-3.39.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-horizon | 14.1.1~dev11-4.45.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-ironic | 11.1.5~dev18-4.35.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-keystone | 14.2.1~dev9-3.38.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-magnum | 7.2.1~dev1-4.37.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-manila | 7.4.2~dev60-3.43.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-monasca | 2.7.1~dev10-3.39.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-monasca-ceilometer | 1.8.2~dev3-3.37.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-neutron | 13.0.8~dev209-6.45.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-nova | 18.3.1~dev92-3.45.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-octavia | 3.2.3~dev7-4.37.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-sahara | 9.0.2~dev15-3.37.1 | SUSE-SU-2023:0844-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-swift | 2.19.2~dev48-2.32.1 | SUSE-SU-2023:0844-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 8 | openstack-cinder | 11.2.3~dev29-3.31.2 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | openstack-cinder-doc | 11.2.3~dev29-3.31.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | openstack-nova | 16.1.9~dev92-3.51.2 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | openstack-nova-doc | 16.1.9~dev92-3.51.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | python-oslo.utils | 3.28.4-3.9.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-aodh | 5.1.1~dev7-12.42.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-barbican | 5.0.2~dev3-12.45.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-ceilometer | 9.0.8~dev7-12.40.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-cinder | 11.2.3~dev29-14.44.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-designate | 5.0.3~dev7-12.41.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-freezer | 5.0.0.0~xrc2~dev2-10.38.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-glance | 15.0.3~dev3-12.41.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-heat | 9.0.8~dev22-12.47.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-horizon | 12.0.5~dev6-14.50.2 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-ironic | 9.1.8~dev8-12.43.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-keystone | 12.0.4~dev11-11.47.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-magnum | 5.0.2_5.0.2_5.0.2~dev31-11.42.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-manila | 5.1.1~dev5-12.47.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-monasca | 2.2.2~dev1-11.47.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-monasca-ceilometer | 1.5.1_1.5.1_1.5.1~dev3-8.38.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-murano | 4.0.2~dev3-12.40.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-neutron | 11.0.9~dev69-13.48.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-nova | 16.1.9~dev92-11.46.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-octavia | 1.0.6~dev3-12.43.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-sahara | 7.0.5~dev4-11.42.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-swift | 2.15.2_2.15.2_2.15.2~dev32-11.33.1 | SUSE-SU-2023:1949-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-trove | 8.0.2~dev2-11.42.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | openstack-cinder | 11.2.3~dev29-3.31.2 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | openstack-cinder-doc | 11.2.3~dev29-3.31.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | openstack-nova | 16.1.9~dev92-3.51.2 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | openstack-nova-doc | 16.1.9~dev92-3.51.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | python-oslo.utils | 3.28.4-3.9.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-aodh | 5.1.1~dev7-12.42.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-barbican | 5.0.2~dev3-12.45.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-ceilometer | 9.0.8~dev7-12.40.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-cinder | 11.2.3~dev29-14.44.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-designate | 5.0.3~dev7-12.41.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-freezer | 5.0.0.0~xrc2~dev2-10.38.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-glance | 15.0.3~dev3-12.41.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-heat | 9.0.8~dev22-12.47.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-horizon-hpe | 12.0.5~dev6-14.50.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-ironic | 9.1.8~dev8-12.43.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-keystone | 12.0.4~dev11-11.47.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-magnum | 5.0.2_5.0.2_5.0.2~dev31-11.42.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-manila | 5.1.1~dev5-12.47.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-monasca | 2.2.2~dev1-11.47.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-monasca-ceilometer | 1.5.1_1.5.1_1.5.1~dev3-8.38.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-murano | 4.0.2~dev3-12.40.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-neutron | 11.0.9~dev69-13.48.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-nova | 16.1.9~dev92-11.46.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-octavia | 1.0.6~dev3-12.43.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-sahara | 7.0.5~dev4-11.42.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-swift | 2.15.2_2.15.2_2.15.2~dev32-11.33.1 | SUSE-SU-2023:1949-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-trove | 8.0.2~dev2-11.42.1 | SUSE-SU-2023:1949-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | cinder | < 19.1.2 | 19.1.2 | GHSA-7h75-hwxx-qpgc |
| PyPI | cinder | >= 20.0.0, < 20.0.2 | 20.0.2 | GHSA-7h75-hwxx-qpgc |
| PyPI | cinder | < 19.1.2 · >= 20.0.0, < 20.0.2 | 19.1.2, 20.0.2 | PYSEC-2026-2411 |
| PyPI | glance | < 23.0.1 | 23.0.1 | GHSA-7h75-hwxx-qpgc |
| PyPI | glance | >= 24.0.0, < 24.1.1 | 24.1.1 | GHSA-7h75-hwxx-qpgc |
| PyPI | glance | < 23.0.1 · >= 24.0.0, < 24.1.1 | 23.0.1, 24.1.1 | PYSEC-2026-2490 |
| PyPI | nova | < 24.1.2 | 24.1.2 | GHSA-7h75-hwxx-qpgc |
| PyPI | nova | >= 25.0.0, < 25.0.2 | 25.0.2 | GHSA-7h75-hwxx-qpgc |
| PyPI | nova | < 24.1.2 · >= 25.0.0, < 25.0.2 | 24.1.2, 25.0.2 | PYSEC-2026-868 |
Advisories 21
- RHSA-2023:1280 Red Hat Security Advisory: Synopsis: Red Hat OpenStack Platform (openstack-glance) security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2023:1279 Red Hat Security Advisory: Synopsis: Red Hat OpenStack Platform (openstack-cinder) security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2023:1278 Red Hat Security Advisory: Red Hat OpenStack Platform (openstack-nova) security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2023:1017 Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (openstack-glance) security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2023:1016 Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (openstack-cinder) security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2023:1015 Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (openstack-nova) security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- USN-6882-2 cinder regression Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-5835-4 cinder vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-5835-3 nova vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-5835-5 nova vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-5835-2 glance vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-5835-1 cinder vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5337-1 nova - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-5336-1 glance - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-5338-1 cinder - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3302-1 nova - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3300-1 glance - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3301-1 cinder - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2023:0844-1 Security update for openstack-cinder, openstack-glance, openstack-neutron-gbp, openstack-nova, python-oslo.utils SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:1949-1 Security update for openstack-cinder, openstack-nova, python-oslo.utils SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-0518 Red Hat OpenStack: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen BSI CERT-Bund (WID) · Jul 10, 2025
References
- https://launchpad.net/bugs/1996188
- https://security.openstack.org/ossa/OSSA-2023-002.html
- [debian-lts-announce] 20230130 [SECURITY] [DLA 3300-1] glance security update mailing-list
- [debian-lts-announce] 20230130 [SECURITY] [DLA 3301-1] cinder security update mailing-list
- [debian-lts-announce] 20230130 [SECURITY] [DLA 3302-1] nova security update mailing-list
- DSA-5336 vendor-advisory
- DSA-5338 vendor-advisory
- DSA-5337 vendor-advisory