Skip to content
OpenAdvisories
Medium · 6.5 CVE-2023-2088 EUVD-2023-33614GHSA-fvf4-jv3j-73mq

A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A …

Published May 12, 2023 · Updated Nov 4, 2025 · Assigned by redhat

Package: cinder Package: cinder Package: ironic Package: nova Package: nova Package: python-glance-store Package: python-glance-store Package: python-os-brick Package: python-os-brick Ecosystem: Debian Ecosystem: Ubuntu

Description

A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A remote, authenticated attacker could exploit this vulnerability by detaching one of their volumes from Cinder. The highest impact is to confidentiality.

Affected products

VendorProductAffectedFixed
— OpenStack unknown —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 cinder 2:21.1.0-3 —
Debian 14 nova 2:26.1.0-4 —
Debian 14 python-glance-store 4.1.0-4 —
Debian 14 python-os-brick 4.1.0-3 —
Debian 13 cinder 2:21.1.0-3 —
Debian 13 nova 2:26.1.0-4 —
Debian 13 python-glance-store 4.1.0-4 —
Debian 13 python-os-brick 4.1.0-3 —
Debian 12 cinder 2:21.1.0-3 —
Debian 12 nova 2:26.1.0-4 —
Debian 12 python-glance-store 4.1.0-4 —
Debian 12 python-os-brick 4.1.0-3 —
Debian 11 cinder 2:17.4.0-1~deb11u2 DLA-3871-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS cinder 2:20.2.0-0ubuntu1.1 USN-6241-1, USN-6073-1
Ubuntu 22.04 LTS ironic 1:20.1.0-0ubuntu1.1 USN-6241-1
Ubuntu 22.04 LTS nova 3:25.1.1-0ubuntu1.1 USN-6241-1, USN-6073-3
Ubuntu 22.04 LTS python-glance-store 3.0.0-0ubuntu1.3 USN-6241-1, USN-6073-2
Ubuntu 22.04 LTS python-os-brick 5.2.2-0ubuntu1.2 USN-6241-1, USN-6073-4
Ubuntu 20.04 LTS cinder 2:16.4.2-0ubuntu2.3 USN-6073-1
Ubuntu 20.04 LTS ironic No fix yet —
Ubuntu 20.04 LTS nova 2:21.2.4-0ubuntu2.3 USN-6073-3
Ubuntu 20.04 LTS python-glance-store 2.0.0-0ubuntu4.1 USN-6073-2
Ubuntu 20.04 LTS python-os-brick 3.0.8-0ubuntu1.1 USN-6073-4
Ubuntu 18.04 LTS ironic +2 No fix yet —
Ubuntu 16.04 LTS cinder +3 No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS nova No fix yet —
Ubuntu Pro 18.04 LTS nova +1 No fix yet —
Ubuntu Pro 16.04 LTS nova No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenStack 17 python-glance-store +1 2.5.1-0.20230509140449.5f1cee6.el9ost RHSA-2023:3157
Red Hat OpenStack 17 python-os-brick +1 4.3.3-0.20220715140803.d09dc9e.el9ost RHSA-2023:3157
Red Hat OpenStack 17 python3-cinder +2 1:18.2.1-0.20230509200451.1776695.el9ost RHSA-2023:3157
Red Hat OpenStack 17 python3-nova +10 1:23.2.2-0.20221209190754.7074ac0.el9ost RHSA-2023:3157
Red Hat OpenStack 17 tripleo-ansible 3.3.1-0.20221208161844.fa5422f.el9ost RHSA-2023:3157
Red Hat OpenStack 16 python-glance-store +1 1.0.2-1.20220219073735.el8ost RHSA-2023:3158, RHSA-2023:3156
Red Hat OpenStack 16 python-os-brick +1 2.10.5-1.20220112193420.634fb4a.el8ost RHSA-2023:3158, RHSA-2023:3156
Red Hat OpenStack 16 python3-cinder +1 1:15.4.0-1.20230510003501.58f0e73.el8ost RHSA-2023:3158, RHSA-2023:3156
Red Hat OpenStack 16 python3-nova +11 1:20.4.1-1.20221005193232.el8ost RHSA-2023:3158, RHSA-2023:3156
Red Hat OpenStack 16 tripleo-ansible 0.8.1-2.20230309004941.el8ost RHSA-2023:3158
Red Hat OpenStack 13 python-glance-store +1 0.23.1-0.20190916165255.cc7ecc1.el7ost RHSA-2023:3161
Red Hat OpenStack 13 python-nova +15 1:17.0.13-41.el7ost RHSA-2023:3161
Red Hat OpenStack 13 python-os-brick +1 2.3.9-12.el7ost RHSA-2023:3161

Advisories 11

References