Cinder vulnerability

2023-02-0900:00:00

ubuntu.com

ubuntu 20.04 lts

ubuntu 18.04 esm

cinder

openstack storage service

vmdk image processing

arbitrary files access

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

0.003

Percentile

66.0%

JSON

Releases

Ubuntu 20.04 LTS
Ubuntu 18.04 ESM

Packages

cinder - OpenStack storage service

Details

USN-5835-1 fixed vulnerabilities in Cinder. This update provides the
corresponding updates for Ubuntu 18.04 LTS. In addition, a regression was
fixed for Ubuntu 20.04 LTS.

Original advisory details:

Guillaume Espanel, Pierre Libeau, Arnaud Morin, and Damien Rannou
discovered that Cinder incorrectly handled VMDK image processing. An
authenticated attacker could possibly supply a specially crafted VMDK flat
image and obtain arbitrary files from the server containing sensitive
information.

OSVersionArchitecturePackageVersionFilename
Ubuntu20.04noarchpython3-cinder< 2:16.4.2-0ubuntu2.2UNKNOWN
Ubuntu20.04noarchcinder-api< 2:16.4.2-0ubuntu2.2UNKNOWN
Ubuntu20.04noarchcinder-backup< 2:16.4.2-0ubuntu2.2UNKNOWN
Ubuntu20.04noarchcinder-common< 2:16.4.2-0ubuntu2.2UNKNOWN
Ubuntu20.04noarchcinder-scheduler< 2:16.4.2-0ubuntu2.2UNKNOWN
Ubuntu20.04noarchcinder-volume< 2:16.4.2-0ubuntu2.2UNKNOWN
Ubuntu18.04noarchpython-cinder< 2:12.0.10-0ubuntu2.2UNKNOWN
Ubuntu18.04noarchcinder-api< 2:12.0.10-0ubuntu2.2UNKNOWN
Ubuntu18.04noarchcinder-backup< 2:12.0.10-0ubuntu2.2UNKNOWN
Ubuntu18.04noarchcinder-common< 2:12.0.10-0ubuntu2.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	20.04	noarch	python3-cinder	< 2:16.4.2-0ubuntu2.2	UNKNOWN
Ubuntu	20.04	noarch	cinder-api	< 2:16.4.2-0ubuntu2.2	UNKNOWN
Ubuntu	20.04	noarch	cinder-backup	< 2:16.4.2-0ubuntu2.2	UNKNOWN
Ubuntu	20.04	noarch	cinder-common	< 2:16.4.2-0ubuntu2.2	UNKNOWN
Ubuntu	20.04	noarch	cinder-scheduler	< 2:16.4.2-0ubuntu2.2	UNKNOWN
Ubuntu	20.04	noarch	cinder-volume	< 2:16.4.2-0ubuntu2.2	UNKNOWN
Ubuntu	18.04	noarch	python-cinder	< 2:12.0.10-0ubuntu2.2	UNKNOWN
Ubuntu	18.04	noarch	cinder-api	< 2:12.0.10-0ubuntu2.2	UNKNOWN
Ubuntu	18.04	noarch	cinder-backup	< 2:12.0.10-0ubuntu2.2	UNKNOWN
Ubuntu	18.04	noarch	cinder-common	< 2:12.0.10-0ubuntu2.2	UNKNOWN