[SECURITY] [DLA 3301-1] cinder security update

2023-01-3022:10:12

lists.debian.org

openstack

cinder

debian

unauthorized access

cve-2022-47951

vmdk

security update

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.003

Percentile

66.0%

JSON

Debian LTS Advisory DLA-3301-1 [email protected]
https://www.debian.org/lts/security/ Utkarsh Gupta
January 31, 2023 https://wiki.debian.org/LTS

Package : cinder
Version : 2:13.0.7-1+deb10u2
CVE ID : CVE-2022-47951
Debian Bug : 1029562

An issue was discovered in OpenStack Cinder, a Block Storage service
for OpenStack. By supplying a specially created VMDK flat image that
references a specific backing file path, an authenticated user may
convince systems to return a copy of that file's contents from the
server, resulting in unauthorized access to potentially sensitive data.

For Debian 10 buster, this problem has been fixed in version
2:13.0.7-1+deb10u2.

We recommend that you upgrade your cinder packages.

For the detailed security status of cinder please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/cinder

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10allpython3-glance< 2:17.0.0-5+deb10u1python3-glance_2:17.0.0-5+deb10u1_all.deb
Debian11allnova-compute-ironic< 2:22.0.1-2+deb11u1nova-compute-ironic_2:22.0.1-2+deb11u1_all.deb
Debian11allcinder-api< 2:17.0.1-1+deb11u1cinder-api_2:17.0.1-1+deb11u1_all.deb
Debian10allnova-common< 2:18.1.0-6+deb10u2nova-common_2:18.1.0-6+deb10u2_all.deb
Debian10allnova-api< 2:18.1.0-6+deb10u2nova-api_2:18.1.0-6+deb10u2_all.deb
Debian11allnova-api< 2:22.0.1-2+deb11u1nova-api_2:22.0.1-2+deb11u1_all.deb
Debian10allnova-conductor< 2:18.1.0-6+deb10u2nova-conductor_2:18.1.0-6+deb10u2_all.deb
Debian11allglance-doc< 2:21.0.0-2+deb11u1glance-doc_2:21.0.0-2+deb11u1_all.deb
Debian10allcinder-scheduler< 2:13.0.7-1+deb10u2cinder-scheduler_2:13.0.7-1+deb10u2_all.deb
Debian10allnova-compute-qemu< 2:18.1.0-6+deb10u2nova-compute-qemu_2:18.1.0-6+deb10u2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	all	python3-glance	< 2:17.0.0-5+deb10u1	python3-glance_2:17.0.0-5+deb10u1_all.deb
Debian	11	all	nova-compute-ironic	< 2:22.0.1-2+deb11u1	nova-compute-ironic_2:22.0.1-2+deb11u1_all.deb
Debian	11	all	cinder-api	< 2:17.0.1-1+deb11u1	cinder-api_2:17.0.1-1+deb11u1_all.deb
Debian	10	all	nova-common	< 2:18.1.0-6+deb10u2	nova-common_2:18.1.0-6+deb10u2_all.deb
Debian	10	all	nova-api	< 2:18.1.0-6+deb10u2	nova-api_2:18.1.0-6+deb10u2_all.deb
Debian	11	all	nova-api	< 2:22.0.1-2+deb11u1	nova-api_2:22.0.1-2+deb11u1_all.deb
Debian	10	all	nova-conductor	< 2:18.1.0-6+deb10u2	nova-conductor_2:18.1.0-6+deb10u2_all.deb
Debian	11	all	glance-doc	< 2:21.0.0-2+deb11u1	glance-doc_2:21.0.0-2+deb11u1_all.deb
Debian	10	all	cinder-scheduler	< 2:13.0.7-1+deb10u2	cinder-scheduler_2:13.0.7-1+deb10u2_all.deb
Debian	10	all	nova-compute-qemu	< 2:18.1.0-6+deb10u2	nova-compute-qemu_2:18.1.0-6+deb10u2_all.deb