USN-5835-1: Cinder vulnerability
31 January 2023
Cinder could be made to expose sensitive information.
Releases
Packages
- cinder - OpenStack storage service
Details
Guillaume Espanel, Pierre Libeau, Arnaud Morin, and Damien Rannou
discovered that Cinder incorrectly handled VMDK image processing. An
authenticated attacker could possibly supply a specially crafted VMDK flat
image and obtain arbitrary files from the server containing sensitive
information.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 22.10
Ubuntu 22.04
Ubuntu 20.04
After a standard system update you need to restart Cinder to make all the
necessary changes.
References
Related notices
- USN-5835-2: python3-glance, glance, glance-common, glance-api, python-glance-doc
- USN-5835-3: nova-volume, nova-scheduler, nova-novncproxy, nova-compute-kvm, nova-api-os-compute, nova-compute-vmware, nova-compute-libvirt, nova-api-os-volume, nova-compute-xen, nova-compute-ironic, nova-compute-lxc, nova-spiceproxy, python3-nova, nova-serialproxy, nova-common, nova-doc, nova-compute, nova-conductor, nova, nova-api, nova-ajax-console-proxy, nova-compute-qemu, nova-api-metadata, nova-cells
- USN-5835-4: cinder-scheduler, python3-cinder, python-cinder, cinder-backup, cinder, cinder-volume, cinder-api, cinder-common
- USN-5835-5: nova-volume, nova-console, nova-scheduler, nova-consoleauth, nova-novncproxy, nova-compute-kvm, nova-api-os-compute, nova-compute-vmware, nova-compute-libvirt, nova-placement-api, nova-api-os-volume, nova-xvpvncproxy, nova-compute-xen, nova-network, nova-compute-lxc, nova-spiceproxy, python-nova, nova-serialproxy, nova-common, nova-doc, nova-compute, nova-conductor, nova, nova-api, nova-ajax-console-proxy, nova-compute-qemu, nova-api-metadata, nova-cells
- USN-6882-2: cinder-scheduler, python3-cinder, cinder-backup, cinder, cinder-volume, cinder-api, cinder-common